https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:25:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-257210 EUVD-2026-257210 https://cve.radiocsirt.org/vuln/euvd-2026-257210 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64102 <p>Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.</p> <p>Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64102 https://cve.radiocsirt.org/vuln/ghsa-xrw9-r35x-x878 <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel/v2, Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A vulnerability in Zitadel allowed brute-force attack on OTP, TOTP and password allowing to impersonate the attacked user.</p> <p>### Impact</p> <p>An attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs.</p> <p>### Affected Versions</p> <p>All versions within the following ranges, including release candidates (RCs), are affected: - **4.x**: `4.0.0` to `4.4.0` (including RC versions) - **3.x**: `3.0.0` to `3.4.2` (including RC versions) - **2.x**: `v2.0.0` to `2.71.17`</p> <p>### Patches</p> <p>The vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing the lockout policy on all OTP, TOTP and password checks. Additionally a “tar pit” has been introduced to slow down brute-force attacks by default. Zitadel responses will be delayed by t seconds, where t increases over the number of failed attempts within a given timeframe.</p> <p>4.x: Upgrade to &gt;=[4.6.0](https://github.com/zitadel/zitadel/releases/tag/v4.6.0) 3.x: Update to &gt;=[3.4.3](https://github.com/zitadel/zitadel/releases/tag/v3.4.3) 2.x: Update to &gt;=[2.71.18](https://github.com/zitadel/zitadel/releases/tag/v2.71.18)</p> <p>### Workarounds…</p> <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel/v2, Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A vulnerability in Zitadel allowed brute-force attack on OTP, TOTP and password allowing to impersonate the attacked user.</p> <p>### Impact</p> <p>An attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs.</p> <p>### Affected Versions</p> <p>All versions within the following ranges, including release candidates (RCs), are affected: - **4.x**: `4.0.0` to `4.4.0` (including RC versions) - **3.x**: `3.0.0` to `3.4.2` (including RC versions) - **2.x**: `v2.0.0` to `2.71.17`</p> <p>### Patches</p> <p>The vulnerability has been addressed in the latest releases. The patch resolves the issue by enforcing the lockout policy on all OTP, TOTP and password checks. Additionally a “tar pit” has been introduced to slow down brute-force attacks by default. Zitadel responses will be delayed by t seconds, where t increases over the number of failed attempts within a given timeframe.</p> <p>4.x: Upgrade to &gt;=[4.6.0](https://github.com/zitadel/zitadel/releases/tag/v4.6.0) 3.x: Update to &gt;=[3.4.3](https://github.com/zitadel/zitadel/releases/tag/v3.4.3) 2.x: Update to &gt;=[2.71.18](https://github.com/zitadel/zitadel/releases/tag/v2.71.18)</p> <p>### Workarounds…</p> https://cve.radiocsirt.org/vuln/ghsa-xrw9-r35x-x878 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15710-1 <p>govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15710-1