CVE-2025-10678
Last modified
CVE-2025-10678 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed. This issue has been fixed in version 0.57.0. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed. This issue has been fixed in version 0.57.0
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-10678?
How severe is CVE-2025-10678?
How do I fix CVE-2025-10678?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-10671A vulnerability has been found in youth-is-as-pale-as-poetry…3.7
- CVE-2025-10672A vulnerability was found in whuan132 AIBattery up to 1.0.9.…7.8
- CVE-2025-10673A vulnerability was determined in itsourcecode Student Infor…9.8
- CVE-2025-10674A vulnerability was identified in fuyang_lipengjun platform …4.3
- CVE-2025-10675A security flaw has been discovered in fuyang_lipengjun plat…4.3
- CVE-2025-10676A weakness has been identified in fuyang_lipengjun platform …4.3
- CVE-2025-10679The ReviewX – WooCommerce Product Reviews with Multi-Criteri…7.3
- CVE-2025-1068There is an untrusted search path vulnerability in Esri ArcG…7.3
- CVE-2025-10680OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platform…8.8
- CVE-2025-10681Storage credentials are hardcoded in the mobile app and devi…8.8
- CVE-2025-10682The TARIFFUXX plugin for WordPress is vulnerable to SQL Inje…6.5
- CVE-2025-10683The Easy Email Subscription plugin for WordPress is vulnerab…4.9
Are you affected by CVE-2025-10678?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST