Multi-Factor Authentication Bypass in Zitadel Policy Enforcement
CVE-2025-64103
What is CVE-2025-64103?
Zitadel's authentication mechanism starting from versions 2.53.6, 2.54.3, and 2.55.0 allowed single-factor authenticated sessions under certain configurations, neglecting the requisite multi-factor authentication (MFA). Users who established MFA without enforcing its necessity could be exposed to attacks focusing solely on compromised TOTP codes, which consist of just six digits. This loophole undermines the efficacy of MFA, as attackers can circumvent the password protection entirely, putting accounts protected by 2FA at risk. The vulnerability has been addressed in versions 4.6.0, 3.4.3, and 2.71.18.
Affected Version(s)
zitadel >= 4.0.0-rc.1, < 4.6.0 < 4.0.0-rc.1, 4.6.0
zitadel >= 3.0.0-rc.1, < 3.4.3 < 3.0.0-rc.1, 3.4.3
zitadel >= 2.55.0, < 2.71.8 < 2.55.0, 2.71.8