CVE-2025-10678 Admin with default credentials in NetBird VPN
Attackers can gain admin access to NetBird VPN instances installed via vendor scripts due to unchanged default ZITADEL admin credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-10678?
CVE-2025-10678 is a critical vulnerability in NetBird, published on 20 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed.
This issue has been fixed in version 0.57.0
Weakness: CWE-1392
Which versions are affected by CVE-2025-10678?
3 open source packages ship an affected version, including github.com/netbirdio/netbird.
| Package | Affected | Fixed in |
|---|---|---|
github.com/netbirdio/netbird Go | All versions | 0.57.0 |
github.com/netbirdio/netbird Go | All versions | 0.57.0 |
github.com/netbirdio/netbird Go | All versions | 0.57.0 |
How do I fix CVE-2025-10678?
Upgrade github.com/netbirdio/netbird to 0.57.0 or later.
Is CVE-2025-10678 being exploited?
There is no known exploitation of CVE-2025-10678 in the wild and no public exploit code.
Sources
Also known as GHSA-g3j4-58mp-3x25, GO-2025-4040.