Most recent entries from all

EUVD-2026-257210

2026-10-03T01:48:21.653090+00:00

EUVD-2026-257210

fkie_cve-2025-64102

2026-10-03T01:48:21.653132+00:00

Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.

GHSA-xrw9-r35x-x878 — Zitadel allows brute-forcing authentication factors

2026-10-03T01:48:21.653170+00:00

Affected: Go: github.com/zitadel/zitadel/v2, Go: github.com/zitadel/zitadel

### Summary

A vulnerability in Zitadel allowed brute-force attack on OTP, TOTP and password allowing to impersonate the attacked user.

### Impact

An attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs.

### Affected Versions

All versions within the following ranges, including release candidates (RCs), are affected: - **4.x**: `4.0.0` to `4.4.0` (including RC versions) - **3.x**: `3.0.0` to `3.4.2` (including RC versions) - **2.x**: `v2.0.0` to `2.71.17`

### Patches

The vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing the lockout policy on all OTP, TOTP and password checks. Additionally a “tar pit” has been introduced to slow down brute-force attacks by default. Zitadel responses will be delayed by t seconds, where t increases over the number of failed attempts within a given timeframe.

4.x: Upgrade to >=[4.6.0](https://github.com/zitadel/zitadel/releases/tag/v4.6.0) 3.x: Update to >=[3.4.3](https://github.com/zitadel/zitadel/releases/tag/v3.4.3) 2.x: Update to >=[2.71.18](https://github.com/zitadel/zitadel/releases/tag/v2.71.18)

### Workarounds…

openSUSE-SU-2025:15710-1 — govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

2026-10-03T01:48:21.653229+00:00

govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media