CVE-2025-10678: NetBird VPN Admin Account Default Password Vulnerability
Summary
CVE-2025-10678: NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird. Affects github.com/netbirdio/netbird versions < 0.57.0. Fixed in 0.57.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NetBird VPN is an open-source virtual private network solution that enables secure communication over the internet. It is designed to provide users with privacy and security while accessing the web. The package is known for its ease of use and robust features, making it a popular choice among developers and organizations. However, a significant vulnerability has been identified that affects the security of admin accounts within the software.
Vulnerability Detail
The vulnerability arises from NetBird VPN's failure to remove the default password of an admin account. This oversight can lead to unauthorized access, allowing malicious actors to exploit the admin privileges without proper authentication. The issue is particularly concerning as it compromises the integrity of the VPN, potentially exposing sensitive data and network configurations to attackers.
How To Fix
Latest published version: v0.81.3 as of 23 Oct 2026
go get github.com/netbirdio/netbird@v0.81.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.57.0
This is the first release that contains the fix.
go get github.com/netbirdio/netbird@v0.57.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to manually change the default admin password immediately after installation. This can be done through the admin interface or configuration files, ensuring that the default credentials are not left unchanged.
Conclusion
The CVE-2025-10678 vulnerability in NetBird VPN poses a significant risk due to the default admin password not being removed. Users are strongly encouraged to update to version 0.57.0 or later to secure their installations. Additionally, changing the default password immediately after installation is a critical step in safeguarding against unauthorized access.
See every vulnerability recorded for github.com/netbirdio/netbird →
FAQ
The vulnerability allows unauthorized access to admin accounts, which can lead to data breaches and unauthorized changes to network configurations.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, a patch is available in version 0.57.0 of the NetBird VPN package. Users should update to this version to mitigate the risk.
If immediate updates are not feasible, ensure to change the default admin password as a temporary measure to secure the account.
More information can be found in the official vulnerability report at https://pkg.go.dev/vuln/GO-2025-4040.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/netbirdio/netbird.
