Go/github.com/zitadel/zitadel CVE-2025-64717: critical 9.8, EPSS 0.50%

ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP in github.com/zitadel/zitadel

Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20251112124840-33c51deb2040 or later.

go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20251112124840-33c51deb2040

Affected

Fixed versions

Sources

• osv: GO-2025-4124
• nvd: CVE-2025-64717
• https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px
• https://github.com/zitadel/zitadel/commit/33c51deb20402dd5720e32cfb0c1d5fdc752f2e0
• https://github.com/zitadel/zitadel/releases/tag/v2.71.19
• https://github.com/zitadel/zitadel/releases/tag/v3.4.4
• https://github.com/zitadel/zitadel/releases/tag/v4.6.6

CVE-2025-64717 · published 2025-11-17T19:11:25Z · modified 2025-11-17T19:58:43.820518Z · JSON