Zitadel up to 4.5.x single-factor authentication

Summaryinfo

A vulnerability identified as very critical has been detected in Zitadel up to 2.53.9/2.54.10/2.71.17/3.4.2/4.5.x. The affected element is an unknown function. The manipulation leads to use of single-factor authentication. This vulnerability is traded as CVE-2025-64103. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Zitadel up to 2.53.9/2.54.10/2.71.17/3.4.2/4.5.x. It has been rated as very critical. This issue affects some unknown functionality. The manipulation with an unknown input leads to a use of single-factor authentication vulnerability. Using CWE to declare the problem leads to CWE-308. The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-64103 since 10/27/2025. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/29/2025). The attack technique deployed by this issue is T1111 according to MITRE ATT&CK.

Upgrading to version 2.71.18, 3.4.3 or 4.6.0 eliminates this vulnerability. Applying the patch b284f8474eed0cba531905101619e7ae7963156b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Zitadel

Version

• 2.53.0
• 2.53.1
• 2.53.2
• 2.53.3
• 2.53.4
• 2.53.5
• 2.53.6
• 2.53.7
• 2.53.8
• 2.53.9
• 2.54.0
• 2.54.1
• 2.54.2
• 2.54.3
• 2.54.4
• 2.54.5
• 2.54.6
• 2.54.7
• 2.54.8
• 2.54.9
• 2.54.10
• 2.71.0
• 2.71.1
• 2.71.2
• 2.71.3
• 2.71.4
• 2.71.5
• 2.71.6
• 2.71.7
• 2.71.8
• 2.71.9
• 2.71.10
• 2.71.11
• 2.71.12
• 2.71.13
• 2.71.14
• 2.71.15
• 2.71.16
• 2.71.17
• 3.4.0
• 3.4.1
• 3.4.2
• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5

License

• open-source

Website

• Product: https://github.com/zitadel/zitadel/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion