CVE-2025-64102 Zitadel allows brute-forcing authentication factors
Attackers can brute-force authentication factors like OTPs and passwords because lockout mechanisms are disabled by default and incomplete in newer APIs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64102?
CVE-2025-64102 is a high-severity authentication bypass vulnerability in zitadel, published on 29 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.
Weakness: CWE-307
Which versions are affected by CVE-2025-64102?
5 open source packages ship an affected version, including github.com/zitadel/zitadel and github.com/zitadel/zitadel/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zitadel/zitadel Go | All versions | None |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8 |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8 |
github.com/zitadel/zitadel/v2 Go | All versions | 2.71.18 |
github.com/zitadel/zitadel/v2 Go | All versions | 2.71.18 |
Products include Zitadel Zitadel.
How do I fix CVE-2025-64102?
Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-64102 being exploited?
There is no known exploitation of CVE-2025-64102 in the wild and no public exploit code.
Other vulnerabilities in zitadel
- CVE-2026-29191 ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
- CVE-2025-67494 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
- CVE-2025-27507 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
- CVE-2025-64103 Zitadel Bypass Second Authentication Factor
- CVE-2025-31123 Zitadel Expired JWT Keys Usable for Authorization Grants
Sources
Also known as GHSA-xrw9-r35x-x878, GO-2025-4085.