CVE-2025-64103: zitadel Improper Authentication

Vulnerability summary

CVE-2025-64103 is a critical (CVSS 9.8) Improper Authentication vulnerability in zitadel. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.4% of scored vulnerabilities.

Timeline

1. 29-10-2025
   PublishedVulnerability first disclosed.
2. 30-10-2025
   Last modifiedVulnerability information updated.

Description

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-308Use of Single-factor AuthenticationThe product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.