CVE-2025-64102: GO-2025-4085 - Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel

CVE-2025-64102 · Severity: critical · CVSS 9.8 · Published 2025-10-29

Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.

Technologies: github.com/zitadel/zitadel (Go), github.com/zitadel/zitadel/v2 (Go), ZITADEL. Vendors: Go, ZITADEL.

Quick answers

Is CVE-2025-64102 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-64102 being exploited in the wild.
How severe is CVE-2025-64102?
Critical severity, with a CVSS score of 9.8, published 29 October 2025.
Which products and versions are affected?
github.com/zitadel/zitadel (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8; github.com/zitadel/zitadel/v2 (Go) SEMVER:introduced=0,fixed=2.71.18.
Is there a fix for CVE-2025-64102?
Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8 or later; github.com/zitadel/zitadel/v2 (Go): upgrade to 2.71.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-64102?
Check whether you run github.com/zitadel/zitadel (Go), github.com/zitadel/zitadel/v2 (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8 or later
    go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8
  • github.com/zitadel/zitadel/v2 (Go): upgrade to 2.71.18 or later
    go get github.com/zitadel/zitadel/v2@v2.71.18

Affected products

  • github.com/zitadel/zitadel (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8
  • github.com/zitadel/zitadel/v2 (Go) SEMVER:introduced=0,fixed=2.71.18
  • ZITADEL

Identifiers

  • CVE-2025-64102
  • GHSA-xrw9-r35x-x878
  • GO-2025-4085

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.