CVE-2025-10678: Admin with default credentials in NetBird VPN

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-20 · updated 2026-10-19
Weakness: CWE-1392

Description

NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed. This issue has been fixed in version 0.57.0

Affected products

NetBird VPN NetBird: before 0.57.0 — fixed in 0.57.0

How to fix

Upgrade to a fixed version: NetBird VPN NetBird 0.57.0. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2025/10/CVE-2025-10678
https://netbird.io/

Get alerted when CVE-2025-10678 or the next vulnerability affects your stack