ZITADEL CVE-2025-67495

Exploitation requires the ZITADEL login UI v2 (login V2) to be in use on an affected version (4.0.0-rc.1 through 4.7.0); the flaw lives in the /logout endpoint, which routes to the unvalidated post_logout_redirect GET parameter. Concrete limiting factors from the advisory: (1) the victim must interact by opening the attacker-crafted logout URL (CVSS UI:R); (2) multiple user sessions must be active in the same browser for the attack to achieve its goal; and (3) account takeover is fully mitigated for accounts protected by Multi-Factor Authentication (MFA) or Passwordless authentication, so only single-factor accounts are at real takeover risk. Instances not running login V2 are not affected.

This is a moderate-severity DOM-based XSS (CWE-79) carrying a realistic-but-conditional risk profile, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) indicates a network-reachable, unauthenticated flaw that nonetheless requires user interaction (UI:R) and yields only limited confidentiality/integrity impact with a scope change into the browser context. EPSS corroborates a relatively low near-term exploitation probability (0.30%, 21st percentile), and there is no CISA KEV listing and no referenced public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision record is provided in the input. The practical risk is tempered by two documented preconditions in the vendor advisory: the victim must have multiple active sessions open in the same browser, and account takeover is mitigated entirely when MFA or Passwordless authentication is enforced - meaning the worst-case (password reset / account takeover) applies mainly to single-factor deployments. Net: a genuine, patch-worthy issue for internet-facing ZITADEL login-V2 instances, but not an emergency mass-exploitation candidate; prioritize based on whether MFA is enforced org-wide.

An attacker crafts a ZITADEL /logout URL with a malicious post_logout_redirect value containing a JavaScript payload and lures a logged-in user (who has one or more active sessions in that browser) to click it. Because the login-V2 UI routes to the attacker-supplied value without validating it, the script executes in the ZITADEL login domain, allowing the attacker to drive a password reset and take over single-factor accounts. No public exploit code is referenced, and success depends on the victim clicking the link (UI:R) and having concurrent active sessions.