NetBird VPN installations via vendor script left ZITADEL admin account with default…

NetBird VPN installations via vendor script left ZITADEL admin account with default password, enabling unauthorized administrative access; fixed in v0.57.0.

CERT Polska coordinated disclosure of CVE-2025-10678 affecting NetBird VPN software. The vulnerability stems from the vendor-provided installation script failing to remove or change the default administrative password for an account created by ZITADEL, NetBird's default identity provider. This configuration flaw allows attackers with knowledge of the default credentials to gain unauthorized administrative access to affected NetBird VPN instances.

The issue impacts installations performed using the vendor's official script and may also affect Docker-based deployments where administrators did not manually change the default password or remove the default admin user. The vulnerability was responsibly disclosed by security researcher Adam Sobieraj and has been remediated in NetBird version 0.57.0.

Organizations running NetBird VPN should immediately upgrade to version 0.57.0 or later and verify that default administrative accounts have been removed or secured with strong, unique credentials. The vulnerability represents a significant authentication bypass risk for affected installations.

title: Successful Authentication Using Default ZITADEL Admin Account
id: bef19c1b-7899-5f6c-aeb3-bf3ba5fefe90
status: experimental
description: 'Detects successful authentication events against the ZITADEL identity
  provider (used by NetBird VPN as its default IdP) using the well-known default administrative
  account name ''zitadel-admin@zitadel.localhost''. Installations performed via the
  vendor''s official install script (CVE-2025-10678) may leave this account enabled
  with its default password, allowing attackers to authenticate as an administrator
  without brute forcing or exploitation of any code vulnerability.

  '
references:
- CVE-2025-10678
author: Vorant
tags:
- attack.t1078.001
- attack.persistence
- attack.defense-evasion
logsource:
  category: authentication
  product: zitadel
detection:
  selection:
    User|contains: zitadel-admin@zitadel.localhost
    EventType: login_success
  filter_rotated:
    AccountRotated: true
  condition: selection and not filter_rotated
falsepositives:
- Administrators who intentionally kept the default account name but changed its password
  for legitimate emergency/break-glass access
- Automated health-check or provisioning scripts that authenticate as the default
  account during initial setup before rotation
level: high

title: NetBird Official Install Script Execution (Potential Default Admin Exposure)
id: e3dc04e7-6722-548e-b83e-8e267117ed6f
status: experimental
description: 'Detects execution of the NetBird vendor-provided installation script
  (getting-started / install.sh style invocation) that provisions a bundled ZITADEL
  identity provider. Versions of this script prior to the fix for CVE-2025-10678 do
  not remove or rotate the default ZITADEL admin account password, leaving newly installed
  NetBird management servers with a default administrative credential. This rule flags
  the install action itself so defenders can follow up with credential rotation.

  '
references:
- CVE-2025-10678
author: Vorant
tags:
- attack.t1078.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains|all:
    - netbird
    - install.sh
  condition: selection
falsepositives:
- Legitimate first-time deployment of NetBird by an administrator who will manually
  rotate the ZITADEL admin password afterward
- Configuration management tooling (Ansible/Terraform) invoking the same install script
  as part of approved infrastructure provisioning
level: low

Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-10678