Executive brief
Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel
Affected products
- Go github.com/zitadel/zitadel/v2
- Go github.com/zitadel/zitadel
Junglewise Threat Intelligence
CVE-2025-64102: GO-2025-4085 - Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel
CVE-2025-64102 · Severity: medium · CVSS 4 · Published 2025-11-05
Technologies: github.com/zitadel/zitadel/v2 (Go), github.com/zitadel/zitadel (Go). Vendors: Go.
Related threats
- ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compati
- ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password v
- ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple proj
- ZITADEL privilege escalation in OAuth2 Token Exchange
- ZITADEL improper authentication in external identity provider auto-linking