Online Brute Force Vulnerability in Zitadel Identity Infrastructure Software
CVE-2025-64102
7.7HIGH
What is CVE-2025-64102?
Zitadel, an open-source identity infrastructure software, is susceptible to online brute-force attacks targeting OTP, TOTP, and passwords in versions prior to 4.6.0, 3.4.3, and 2.71.18. Although Zitadel has a built-in lockout mechanism to thwart such attacks, it is not enabled by default. This lack of default protection can inadvertently lead to denial of service for users when enabled. Additionally, updates to resource-based APIs have not fully implemented necessary mitigation strategies, highlighting the need for users to promptly upgrade to secure versions.
Affected Version(s)
zitadel >= 4.0.0-rc.1, < 4.6.0 < 4.0.0-rc.1, 4.6.0
zitadel >= 3.0.0-rc.1, < 3.4.3 < 3.0.0-rc.1, 3.4.3
zitadel >= 2.0.0, < 2.71.18 < 2.0.0, 2.71.18