PT-2025-44342 · Zitadel · Zitadel

Published 2025-10-29 · Updated 2025-11-07 · CVE-2025-64102

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zitadel versions prior to 4.6.0 Zitadel versions prior to 3.4.3 Zitadel versions prior to 2.71.18

Description Zitadel, an open-source identity infrastructure software, is susceptible to online brute-force attacks targeting OTP, TOTP, and passwords. The built-in lockout mechanism designed to prevent such attacks is not enabled by default and, if enabled, can potentially cause a denial of service for individual users. Furthermore, the mitigation strategies were not fully implemented in the newer resource-based APIs.

Recommendations Update to Zitadel version 4.6.0 or later. Update to Zitadel version 3.4.3 or later. Update to Zitadel version 2.71.18 or later.

Exploit

Fix

DoS

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-64102

GHSA-XRW9-R35X-X878

GO-2025-4085

OPENSUSE-SU-2025:15710-1

Affected Products

Zitadel

References · 83

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64102.json · Exploit
• https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a · Patch
• https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4085 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64102 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xrw9-r35x-x878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64102 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://github.com/zitadel/zitadel · Note
• https://suse.com/security/cve/CVE-2016-11082 · Note
• https://suse.com/security/cve/CVE-2025-62157 · Note
• https://suse.com/security/cve/CVE-2025-62714 · Note
• https://suse.com/security/cve/CVE-2016-11075 · Note
• https://suse.com/security/cve/CVE-2025-62705 · Note
• https://suse.com/security/cve/CVE-2016-11079 · Note