CVE-2025-64717 is a critical (CVSS 9.8) authentication flaw in ZITADEL. Its federation process could auto link an outside identity provider login to an existing account even when that provider was disabled, risking account takeover. Fixed in 4.6.6, 3.4.4 and 2.71.19; there is no workaround.
What's affected
The GitHub advisory (GHSA-j4g7-v4m4-77px) gives these affected ranges:
- 4.x: 4.0.0-rc.1 through 4.6.5
- 3.x: 3.0.0-rc.1 through 3.4.3
- 2.x: 2.50.0 through 2.71.18
Fixed releases are 4.6.6, 3.4.4 and 2.71.19. The advisory says no workarounds are known aside from upgrading.
Two limits from the record shape who is at risk. Accounts with MFA enabled cannot be taken over by this attack. And the attack only works with identity providers created at the instance level; providers registered on another organization are always denied in the linking step.
How to check if you're exposed
Check your ZITADEL release first:
docker ps --format '{{.Names}} {{.Image}}'
go list -m all | grep -i zitadel
Then review your configuration against the two conditions in the advisory:
- Do you have identity providers defined at the instance level?
- Do any organizations disable an IdP or disallow federated authentication through their login policy?
If both are true, the policy you set was not being honored in the auto linking step, so treat those organizations as exposed until upgraded. Next, list users without MFA enrolled, since those are the accounts the record says could be taken over. Your audit logs should show external identity links created recently. Look for links you cannot explain.
What to do now
- Upgrade to ZITADEL 4.6.6, 3.4.4 or 2.71.19 or later. The advisory lists no workaround.
- Review external identity links on existing accounts, especially links created through instance level providers in organizations that have federation disabled.
- Remove any link you cannot tie to a real user and force a credential reset and session revocation for the affected account.
- Encourage or require MFA for users. The record states MFA enabled accounts cannot be taken over by this attack.
- After upgrading, test that a disabled IdP is rejected for an organization whose login policy disallows federation.
Why it matters
The weakness is CWE-287, improper authentication, in the form of a missed policy check. An organization administrator could disable an identity provider or turn federation off, and the login flow honored that for ordinary sign in. The auto linking path did not. It trusted a matching attribute from an outside provider and attached the external identity to an internal account.
The advisory credits Jan Kühnlein of kultify with the report. The fix validates the organization login policy before linking. The lesson reaches beyond ZITADEL: every path that can create a session or a link, including the clever convenience paths, has to ask the same policy question. The record does not list this CVE in CISA Known Exploited Vulnerabilities.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Are MFA protected accounts affected?
No. The record says accounts with MFA enabled cannot be taken over by this attack.
Is there a workaround?
The advisory says no known workarounds exist aside from upgrading to 4.6.6, 3.4.4 or 2.71.19.
Sources
Last reviewed: 18 October 2026.
