CVE-2025-64717

CVE-2025-64717 is a critical vulnerability in ZITADEL versions 2.50.0 through 2.71.18, 3.4.3, and 4.6.5, allowing unauthenticated attackers to bypass security controls during the federation process. The flaw enables auto-linking of external identity provider (IdP) accounts to existing ZITADEL users, even when the IdP is disabled or federation is disallowed by the organization. This can lead to full account takeover for accounts without multi-factor authentication (MFA). Rated with a CVSS score of 9.8 (CRITICAL), this vulnerability has a network attack vector, low attack complexity, and requires no user interaction, resulting in high impacts to confidentiality, integrity, and availability. The root cause is a failure to properly enforce organization-specific security settings during the authentication flow, specifically CWE-287 (Improper Authentication). There is no evidence of active exploitation, nor are there publicly available Metasploit, Nuclei, or ExploitDB modules. However, the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness and potential interest in developing exploits. Organizations are advised to upgrade to ZITADEL versions 2.71.19, 3.4.4, or 4.6.6 immediately, as no other workarounds exist.