{"action":"Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20251112124840-33c51deb2040 or later.","affected":[{"fixed":"4.6.6","introduced":"4.0.0-rc.1"},{"fixed":"3.4.4","introduced":"3.0.0-rc.1"},{"fixed":"2.71.19","introduced":"2.50.0"},{"fixed":"1.80.0-v2.20.0.20251112124840-33c51deb2040","introduced":"1.80.0-v2.20.0.20240403060621-5b3946b67ef6"}],"component":"github.com/zitadel/zitadel","cve_ids":["CVE-2025-64717"],"ecosystem":"Go","epss":0.00495,"exploited":false,"fixed_versions":["4.6.6","3.4.4","2.71.19","1.80.0-v2.20.0.20251112124840-33c51deb2040"],"ghsa_id":"GHSA-j4g7-v4m4-77px","id":"tcs_01M5KFDFGASY1R7EFCEJD5ZX41","modified_at":"2025-11-17T19:58:43.820518Z","published_at":"2025-11-14T21:11:38Z","references":["https://osv.dev/vulnerability/GHSA-j4g7-v4m4-77px","https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px","https://nvd.nist.gov/vuln/detail/CVE-2025-64717","https://github.com/zitadel/zitadel/commit/33c51deb20402dd5720e32cfb0c1d5fdc752f2e0","https://github.com/zitadel/zitadel","https://github.com/zitadel/zitadel/releases/tag/v2.71.19","https://github.com/zitadel/zitadel/releases/tag/v3.4.4","https://github.com/zitadel/zitadel/releases/tag/v4.6.6"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-j4g7-v4m4-77px","url":"https://osv.dev/vulnerability/GHSA-j4g7-v4m4-77px"},{"source":"nvd","source_id":"CVE-2025-64717","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64717"}],"summary":"ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP"}