CVE-2025-10678

CRITICAL

NetBird < 0.57.0 - Use of Default Credentials in Admin Account

Title source: llm
STIX 2.1

Description

NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed. This issue has been fixed in version 0.57.0

References (2)

Core 2
Core References
Various Sources third-party-advisory
https://cert.pl/en/posts/2025/10/CVE-2025-10678
Various Sources product
https://netbird.io/

Scores

CVSS v4 9.3
EPSS 0.0035
EPSS Percentile 26.4%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-1392
Status published
Products (2)
NetBird VPN/NetBird < 0.57.0
netbirdio/netbird 0 - 0.57.0Go
Published Oct 20, 2025
Tracked Since Feb 18, 2026