GHSA-cfjq-28r2-4jv5 CVE-2025-64103 GO-2025-4083

Zitadel May Bypass Second Authentication Factor

Critical Go

Severity: 0.0 / 10; Critical · CVSS 4.0
Exploit chance (EPSS): 0.35%; Chance of exploitation in the next 30 days. Higher than 28.91% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-287 Improper Authentication; CWE-308 Use of Single-factor Authentication
Fix: Available; 2 packages have a fixed version

Description

Summary

A vulnerability in Zitadel's token verification prematurely marked sessions as authenticated when only one factor was verified.

Impact

Zitadel provides an API for managing sessions, enabling custom login experiences in a dedicated UI or direct integration into applications. Session Tokens are issued for active sessions, which can be used as Bearer tokens to call the Zitadel API.

Starting from 2.55.0 (see other affected versions below), Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors.

Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled.

Affected Versions

Systems using the session API (v2 beta and v2) directly or via the new login UI in the following versions are affected:

4.x: 4.0.0 to 4.5.0 (including RC versions)
3.x: 3.0.0 to 3.4.2 (including RC versions)
2.x: v2.53.6 to v2.53.9, v2.54.3 to v2.54.10, 2.55.0 to 2.71.17

Patches

The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring a configured second factor regardless of the login policies requireMFA or requireMFAForLocalUsers configuration.

4.x: Upgrade to >=4.6.0 3.x: Update to >=3.4.3 2.x: Update to >=2.71.18

Workarounds

The recommended solution is to update Zitadel to a patched version.

Questions

If you have any questions or comments about this advisory, please email us at security@zitadel.com

Credits

This vulnerability was found by zentrust partners GmbH during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann. The full report will be made public after the complete review.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/zitadel/zitadel	`< 1.80.0-v2.20.0.20251029091250-b284f8474eed`	`1.80.0-v2.20.0.20251029091250-b284f8474eed`
github.com/zitadel/zitadel	`all versions`	No fix yet
github.com/zitadel/zitadel/v2	`>= 2.53.6, <= 2.53.9`	No fix yet
github.com/zitadel/zitadel/v2	`>= 2.54.3, <= 2.54.10`	No fix yet
github.com/zitadel/zitadel/v2	`>= 2.55.0, < 2.71.18`	`2.71.18`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/zitadel/zitadel Go → `1.80.0-v2.20.0.20251029091250-b284f8474eed`

go

go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20251029091250-b284f8474eed && go mod tidy

github.com/zitadel/zitadel/v2 Go → `2.71.18`

go

go get github.com/zitadel/zitadel/v2@v2.71.18 && go mod tidy

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): High
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it

Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

CWE-308: Use of Single-factor Authentication

The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

How to prevent it

Architecture and Design: Use multiple independent authentication schemes, which ensures that -- if one of the methods is compromised -- the system itself is still likely safe from compromise. For this reason, if multiple schemes are possible, they should be implemented and required -- especially if they are easy to use.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2025-64103

Packages

github.com/zitadel/zitadel

Timeline

Oct 29, 2025 Published
Oct 19, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-fgmf-7rf8-m6vf ZITADEL: Actions V1 sandbox escape: host file read via require()	High	Also affects github.com/zitadel/zitadel
GHSA-9993-rfwp-rhwf ZITADEL: MFA bypass via session reuse in Login V2	High	Also affects github.com/zitadel/zitadel
GHSA-v859-c572-qh5p ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions	Medium	Also affects github.com/zitadel/zitadel
GHSA-jq8w-8q2f-ffm9 ZITADEL Users Can Self-Verify Email/Phone via API	High	Also affects github.com/zitadel/zitadel
GHSA-vrh8-c9cm-wh8v ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange	High	Also affects github.com/zitadel/zitadel
GHSA-992q-9gwp-7r79 ZITADEL: Auto-linking by email: IdP-side email verification is not checked	Medium	Also affects github.com/zitadel/zitadel
GHSA-v77h-2w3m-94hx ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider	Medium	Also affects github.com/zitadel/zitadel
GHSA-g5h5-m4hm-xjrr ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider	Medium	Also affects github.com/zitadel/zitadel

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor