# CVE-2025-64102: GO-2025-4085 - Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel

Source: https://junglewise.ai/threats/cve-2025-64102-zitadel-allows-brute-forcing-authentication-factors  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-29  
License: CC BY 4.0 with a link back

CVE-2025-64102 · Severity: critical · CVSS 9.8 · Published 2025-10-29

Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.

Technologies: [github.com/zitadel/zitadel (Go)](https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel), [github.com/zitadel/zitadel/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel-v2), [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2025-64102 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64102 being exploited in the wild.

**How severe is CVE-2025-64102?** Critical severity, with a CVSS score of 9.8, published 29 October 2025.

**Which products and versions are affected?** github.com/zitadel/zitadel (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8; github.com/zitadel/zitadel/v2 (Go) SEMVER:introduced=0,fixed=2.71.18.

**Is there a fix for CVE-2025-64102?** Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8 or later; github.com/zitadel/zitadel/v2 (Go): upgrade to 2.71.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-64102?** Check whether you run github.com/zitadel/zitadel (Go), github.com/zitadel/zitadel/v2 (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8 or later

  ```sh
  go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8
  ```

- github.com/zitadel/zitadel/v2 (Go): upgrade to 2.71.18 or later

  ```sh
  go get github.com/zitadel/zitadel/v2@v2.71.18
  ```


## Affected products

- github.com/zitadel/zitadel (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8
- github.com/zitadel/zitadel/v2 (Go) SEMVER:introduced=0,fixed=2.71.18
- ZITADEL

## Identifiers

- CVE-2025-64102
- GHSA-xrw9-r35x-x878
- GO-2025-4085

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)