CVE-2025-64102

Katalog CVE

CVSS 9.8 · Critical EPSS 0,37%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada zitadel. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.

Rincian

Terbit di NVD

29 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878 advisory vendor
• https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a patch