N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-10678

CVE-2025-10678: NetBird VPN does not remove the default password of an admin account

NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed.

This issue has been fixed in version 0.57.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-10678

CVE-2025-10678:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/netbirdio/netbird	go	< 0.57.0	0.57.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-10678, is not within the Go application code of NetBird but rather in the deployment script infrastructure_files/getting-started-with-zitadel.sh. The script failed to remove the default zitadel-admin user created by Zitadel during installation, leaving a default credential in the system.

The patch, commit cf7f6c355f713e83cf171b79e08dac60b316e4fd, addresses this by introducing a new shell function, delete_default_zitadel_admin, and modifying the existing init_zitadel function to call it. This ensures the default administrative user is removed upon setup.

Since the vulnerability lies within a shell script and not the Go source code, no vulnerable functions from the github.com/netbirdio/netbird Go package would appear in a runtime profile. The exploitation of this vulnerability involves logging in with default credentials, which would trigger normal authentication and authorization flows rather than a specific, flawed function in the Netbird application. The identified function, init_zitadel, is a shell function and is considered 'vulnerable' in the sense that it was responsible for the insecure configuration.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.