An unauthenticated DOM-based XSS vulnerability in ZITADEL version 4.7.0 and earlier allows remote attackers to execute malicious scripts in user browsers, posing a risk of session compromise.

This is a DOM-Based Cross-Site Scripting (CWE-79) flaw residing in the /logout endpoint. An unauthenticated attacker can manipulate the post_logout_redirect parameter to inject and execute arbitrary JavaScript code within the context of the user's browser session.

Successful exploitation allows an attacker to execute arbitrary scripts, potentially leading to unauthorized actions performed on behalf of the user. Given the CVSS score of 8.0, this represents a high-severity risk that could facilitate session hijacking or redirection to malicious sites, though account takeover is partially mitigated by the use of MFA or passwordless authentication.

Immediate Action: Upgrade ZITADEL to version 4.7.1 or later to apply the necessary security patches for the logout endpoint.

Proactive Monitoring: Monitor authentication and logout logs for unusual patterns or unexpected redirects originating from the /logout endpoint.

Compensating Controls: Implement a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block malicious payloads in URL parameters.

Public Exploit Available: Unknown.

The vulnerability poses a significant risk to user session integrity. Administrators should prioritize upgrading to version 4.7.1 immediately to eliminate the underlying flaw in the logout handling logic, thereby preventing potential script injection attacks.