CVE-2025-10678: NetBird VPN Fails to Remove Default Admin Password
Summary
CVE-2025-10678: NetBird VPN does not remove the default password of an admin account. Affects github.com/netbirdio/netbird versions < 0.57.0. Fixed in 0.57.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NetBird VPN is a secure networking solution that allows users to create private networks over the internet. It is designed to facilitate secure communication and data transfer between devices. The package is known for its ease of installation and configuration, often using vendor-provided scripts. However, this convenience can lead to security oversights, particularly regarding default credentials.
Vulnerability Detail
The vulnerability arises from the NetBird VPN installation process, where the vendor's provided script does not remove or change the default password of an admin account created by ZITADEL. This oversight can lead to unauthorized access if the default password is not changed, posing a significant security risk. Instances installed using the vendor's script or Docker without altering the default credentials are particularly vulnerable. The issue is classified under CWE-1392, indicating a failure to manage sensitive information properly.
How To Fix
Latest published version: v0.81.3 as of 23 Oct 2026
go get github.com/netbirdio/netbird@v0.81.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.57.0
This is the first release that contains the fix.
go get github.com/netbirdio/netbird@v0.57.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should manually change the default password of the admin account created by ZITADEL immediately after installation. This can be done through the admin interface or command line, depending on the setup. Additionally, consider removing the default admin account if it is not needed.
Conclusion
In summary, CVE-2025-10678 highlights a critical security oversight in NetBird VPN installations that can lead to unauthorized access. Users are advised to update to version 0.57.0 to mitigate this risk and implement immediate changes to default credentials where applicable.
See every vulnerability recorded for github.com/netbirdio/netbird →
FAQ
CVE-2025-10678 is a critical vulnerability in NetBird VPN that allows unauthorized access due to the failure to remove the default admin password.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability can lead to unauthorized access to your VPN, potentially compromising sensitive data and network security.
Yes, the vulnerability has been fixed in version 0.57.0 of NetBird VPN. Users are encouraged to update to this version.
If an immediate update is not possible, ensure to change the default admin password and consider removing the admin account if it is not necessary.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/netbirdio/netbird.
