Executive brief
NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird
Affected products
- Go github.com/netbirdio/netbird
Junglewise Threat Intelligence
CVE-2025-10678: GO-2025-4040 - NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird
CVE-2025-10678 · Severity: medium · CVSS 4 · Published 2025-10-30
Technologies: github.com/netbirdio/netbird (Go). Vendors: Go.
Related threats
- GO-2026-5646 - NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner in github.com/netbirdio/netbird
- NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner
- GO-2024-3057 - NetBird uses a static initialization vector (IV) in github.com/netbirdio/netbird