CVE-2025-64103: GO-2025-4083 - Zitadel May Bypass Second Authentication Factor in github.com/zitadel/zitadel

CVE-2025-64103 · Severity: critical · CVSS 9.8 · Published 2025-10-29

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.

Technologies: github.com/zitadel/zitadel (Go), github.com/zitadel/zitadel/v2 (Go), ZITADEL. Vendors: Go, ZITADEL.

Quick answers

Is CVE-2025-64103 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-64103 being exploited in the wild.
How severe is CVE-2025-64103?
Critical severity, with a CVSS score of 9.8, published 29 October 2025.
Which products and versions are affected?
github.com/zitadel/zitadel (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20251029091250-b284f8474eed; github.com/zitadel/zitadel/v2 (Go) SEMVER:introduced=2.53.6,last_affected=2.53.9.
Is there a fix for CVE-2025-64103?
Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20251029091250-b284f8474eed or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-64103?
Check whether you run github.com/zitadel/zitadel (Go), github.com/zitadel/zitadel/v2 (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20251029091250-b284f8474eed or later
    go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20251029091250-b284f8474eed

Affected products

  • github.com/zitadel/zitadel (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20251029091250-b284f8474eed
  • github.com/zitadel/zitadel/v2 (Go) SEMVER:introduced=2.53.6,last_affected=2.53.9
  • ZITADEL

Identifiers

  • CVE-2025-64103
  • GHSA-cfjq-28r2-4jv5
  • GO-2025-4083

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.