tocsin

Go/github.com/zitadel/zitadel CVE-2025-64717: high, EPSS 0.50%

ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP

Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20251112124840-33c51deb2040 or later.

go get github.com/zitadel/zitadel@v4.6.6
go get github.com/zitadel/zitadel@v3.4.4
go get github.com/zitadel/zitadel@v2.71.19
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20251112124840-33c51deb2040

Affected

introducedfixedlast affected
4.0.0-rc.14.6.6-
3.0.0-rc.13.4.4-
2.50.02.71.19-
1.80.0-v2.20.0.20240403060621-5b3946b67ef61.80.0-v2.20.0.20251112124840-33c51deb2040-

Fixed versions

4.6.63.4.42.71.191.80.0-v2.20.0.20251112124840-33c51deb2040

Sources

CVE-2025-64717 · published · modified · JSON