CVE-2025-67495: 
NixOS vulnerability analysis and mitigation

CVE-2025-67495 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in ZITADEL's Login V2 /logout endpoint that can lead to account takeover. The /logout endpoint insecurely processes the post_logout_redirect GET parameter without validation, allowing arbitrary JavaScript execution in the ZITADEL V2 Login domain. Affected versions include ZITADEL v4.0.0-rc.1 through v4.7.0 (and certain v1.x builds using the v2 login UI). The vulnerability was discovered by Amit Laish of GE Vernova and disclosed on December 8, 2025. The GitHub Security Advisory rates it as High severity with a CVSS v3.1 score of 8.0, while NVD assigns a score of 6.1 (Medium) (Github Advisory, Zitadel Advisory).

The root cause is improper neutralization of user-controlled input (CWE-79) in the ZITADEL Login V2 UI. The /logout endpoint accepts a post_logout_redirect GET parameter and redirects users to the supplied URL without validating that it contains an allowed value or sanitizing embedded scripts. An unauthenticated remote attacker can craft a malicious URL containing JavaScript code as the post_logout_redirect value; when a victim visits this URL, the browser executes the injected script within the ZITADEL V2 Login domain. The fix, implemented in commit 4c879b4, resolves the issue by passing logout state information via a signed JWT (logout_token) rather than raw query parameters, ensuring the data is cryptographically verified against the instance's OAuth2/OIDC public keys (Zitadel Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the victim's browser within the ZITADEL V2 Login domain, potentially enabling full account takeover by triggering a password reset on behalf of the victim. This attack requires multiple user sessions to be active in the same browser simultaneously, and account takeover is mitigated for accounts with Multi-Factor Authentication (MFA) or Passwordless authentication enabled. The confidentiality and integrity impacts are high for affected accounts (access to session data, ability to modify account credentials), though availability is not directly impacted (Github Advisory, Zitadel Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.044% (14th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (victim must click a crafted link) and multiple active sessions in the same browser, which somewhat limits the attack surface (Github Advisory).

1. Reconnaissance: Identify ZITADEL instances running Login V2 (versions 4.0.0-rc.1 through 4.7.0) that are publicly accessible. ZITADEL Cloud and self-hosted deployments using the v2 login UI are both potentially affected.
2. Craft malicious URL: Construct a URL targeting the /logout endpoint of the vulnerable ZITADEL instance with a malicious post_logout_redirect parameter containing JavaScript, e.g., https://<zitadel-instance>/logout?post_logout_redirect=javascript:alert(document.cookie) or a more sophisticated payload designed to trigger a password reset.
3. Social engineering: Deliver the crafted URL to a target victim who is already authenticated to the ZITADEL instance (e.g., via phishing email, malicious link in a message, or embedded in a web page). The victim must have multiple active user sessions in the same browser.
4. Trigger XSS: When the victim clicks the link and the /logout endpoint processes the request, the browser is redirected to the attacker-controlled post_logout_redirect value, executing the injected JavaScript within the ZITADEL V2 Login domain.
5. Account takeover: The malicious script leverages the victim's active session context to initiate a password reset, capture session tokens, or perform other privileged actions, ultimately enabling the attacker to take over the victim's account (Zitadel Advisory).

• Network: Unusual HTTP GET requests to /logout endpoint with a post_logout_redirect parameter containing javascript:, data:, or encoded script payloads; unexpected outbound redirects from the ZITADEL login domain to external or unusual URLs.
• Logs: ZITADEL access logs showing requests to /logout?post_logout_redirect=<encoded_payload> from external or unexpected IP addresses; repeated logout requests with varying post_logout_redirect values suggesting probing activity.
• Application Behavior: Unexpected password reset emails sent to users who did not initiate a reset; user accounts with recently changed credentials not initiated by the account owner; multiple active sessions terminated unexpectedly.

The primary remediation is to upgrade ZITADEL to version 4.7.1 or later (for v4.x deployments), which resolves the issue by passing logout state via a signed JWT (logout_token) instead of raw query parameters. For deployments running custom login UIs, switch to the new logout_token parameter and verify the JWT signature using the instance's OAuth2/OIDC public keys (jwks_uri). Before upgrading, ensure ZITADEL_API_URL is correctly set, the HTTP host (or x-forwarded-host) is forwarded by the reverse proxy, and for multi-instance deployments, x-zitadel-instance-host is configured. As an interim risk reduction measure, enforcing MFA or Passwordless authentication for all users will mitigate the account takeover impact even if XSS is triggered (Zitadel Advisory, Github Advisory).

Security news outlet SecurityOnline.info covered the vulnerability alongside a companion SSRF flaw (CVE-2025-67494, CVSS 9.3), highlighting the dual risk of SSRF and account hijack via XSS in ZITADEL. The vulnerability was credited to Amit Laish of GE Vernova, indicating responsible disclosure through a coordinated process with the ZITADEL security team. Community discussion was noted on Bluesky shortly after disclosure. No major threat actor attribution or widespread social media controversy has been reported.