UpHeron
All vulnerabilities

Servers and applications

CVE-2025-64717

Account Takeover with deactivated Instance IdP

Severity
High 7.4
Published
12 Nov 2025
Last changed
19 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.71.19, 3.4.4, 4.6.6
Also known as
GHSA-j4g7-v4m4-77px
Sources
NVD, Project advisories (GitHub)

Description

ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication. This vulnerability…

Affected software

SoftwareAffected versions
ZITADELServers and applications · cpe:a:zitadel:zitadel
  • From 2.50.0 before 2.71.19
  • From 3.0.0 before 3.4.4
  • From 4.0.0 before 4.6.6
ZITADELServers and applications · github:zitadel/zitadel
  • From 2.50.0 before 2.71.19
  • From 3.0.0 before 3.4.4
  • From 4.0.0 before 4.6.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-64717
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64717
  • GitHub Advisory Database https://github.com/advisories/GHSA-j4g7-v4m4-77px
  • github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-j4g7-v4m4-77px