CVE-2025-10678: NetBird VPN Auth Bypass Vulnerability

CVE-2025-10678 Overview

CVE-2025-10678 is a critical hardcoded credentials vulnerability affecting NetBird VPN installations. When installed using the vendor's provided script, NetBird VPN fails to remove or change the default password of an admin account created by ZITADEL. This vulnerability allows unauthenticated remote attackers to gain full administrative access to affected NetBird VPN instances using the well-known default credentials.

The vulnerability impacts instances installed using the vendor's provided installation script, as well as Docker-based deployments where administrators failed to change the default password or remove the default admin user. This represents a severe security configuration weakness (CWE-1392: Use of Default Credentials) that could lead to complete compromise of the VPN infrastructure.

Critical Impact
Unauthenticated attackers can gain full administrative access to NetBird VPN instances using default ZITADEL admin credentials, potentially compromising the entire VPN network infrastructure and connected systems.

Affected Products

NetBird VPN versions prior to 0.57.0 installed using vendor's provided script
NetBird VPN Docker deployments where default ZITADEL admin password was not changed
NetBird VPN instances where the default ZITADEL admin user was not removed

Discovery Timeline

2025-10-20 - CVE-2025-10678 published to NVD
2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-10678

Vulnerability Analysis

This vulnerability stems from insecure default configuration in the NetBird VPN installation process. When administrators deploy NetBird VPN using the vendor-provided installation script, the ZITADEL identity management component creates an administrative account with a default password. The installation script fails to prompt for password changes or automatically remove this default account, leaving instances vulnerable to unauthorized access.

The network-accessible nature of this vulnerability combined with the lack of authentication requirements makes it trivially exploitable. An attacker with network access to the NetBird management interface can authenticate using the default ZITADEL admin credentials and gain complete control over the VPN infrastructure.

Successful exploitation would allow attackers to:

Access and modify VPN configuration settings
Create, modify, or delete user accounts
Monitor VPN traffic and connected clients
Potentially pivot to internal network resources accessible through the VPN
Exfiltrate sensitive network configuration data

Root Cause

The root cause of CVE-2025-10678 is the use of default credentials (CWE-1392) in the ZITADEL identity management component during NetBird VPN installation. The vendor's installation script does not enforce credential rotation or removal of the default administrative account, leaving a predictable authentication bypass path for attackers.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying internet-exposed NetBird VPN management interfaces through network scanning
Attempting authentication with known default ZITADEL admin credentials
Upon successful authentication, gaining full administrative privileges over the VPN instance

The exploitation requires no special tools or techniques—only knowledge of the default credentials and network access to the management interface.

Detection Methods for CVE-2025-10678

Indicators of Compromise

Successful authentication events for the default ZITADEL admin account from external IP addresses
Unexpected administrative configuration changes in NetBird VPN settings
Creation of new user accounts or modification of existing accounts without authorized administrator action
Unusual login patterns or access times for administrative accounts

Detection Strategies

Monitor authentication logs for successful logins using default admin credentials
Implement alerting for administrative actions from unrecognized IP addresses or unusual geographic locations
Review ZITADEL audit logs for unauthorized privilege escalation or account modifications
Conduct regular credential audits to identify accounts still using default passwords

Monitoring Recommendations

Enable comprehensive logging for all authentication events on NetBird VPN management interfaces
Configure SIEM rules to detect authentication attempts using known default account names
Implement network monitoring to identify unauthorized access to management ports
Set up alerts for any configuration changes to critical VPN infrastructure components

How to Mitigate CVE-2025-10678

Immediate Actions Required

Immediately change the default ZITADEL admin password on all NetBird VPN instances
If the default admin account is not required, remove it entirely from the system
Upgrade all NetBird VPN installations to version 0.57.0 or later
Restrict network access to management interfaces using firewall rules
Audit authentication logs for signs of prior unauthorized access using default credentials

Patch Information

NetBird has addressed this vulnerability in version 0.57.0. Organizations should upgrade to this version or later immediately. For detailed information about the fix and upgrade procedures, refer to the CERT Poland CVE-2025-10678 Analysis and the NetBird Official Website.

Workarounds

Change the default ZITADEL admin password immediately upon installation if upgrading is not immediately possible
Remove the default admin account entirely and create a new administrative account with strong credentials
Implement network segmentation to restrict access to the NetBird management interface to trusted internal networks only
Enable multi-factor authentication for all administrative accounts if supported
Deploy a web application firewall or reverse proxy to add additional authentication layers in front of the management interface

bash

# Configuration example
# Restrict access to NetBird management interface via firewall
# Allow only trusted administrator IP ranges
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Verify no default admin accounts exist
# Review ZITADEL user list and remove default accounts