CVE-2025-64103

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64103", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-27T15:26:14.127Z", "datePublished": "2025-10-29T18:43:46.934Z", "dateUpdated": "2025-10-30T14:51:19.189Z"}, "containers": {"cna": {"title": "Zitadel Bypass Second Authentication Factor", "problemTypes": [{"descriptions": [{"cweId": "CWE-308", "lang": "en", "description": "CWE-308: Use of Single-factor Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5"}, {"name": "https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b"}], "affected": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"version": ">= 4.0.0-rc.1, < 4.6.0", "status": "affected"}, {"version": ">= 3.0.0-rc.1, < 3.4.3", "status": "affected"}, {"version": ">= 2.55.0, < 2.71.18", "status": "affected"}, {"version": ">= 2.54.3, <= 2.54.10", "status": "affected"}, {"version": ">= 2.53.6, <= 2.53.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-29T20:42:41.527Z"}, "descriptions": [{"lang": "en", "value": "Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18."}], "source": {"advisory": "GHSA-cfjq-28r2-4jv5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-30T14:51:11.506264Z", "id": "CVE-2025-64103", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:51:19.189Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64103", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-30T14:51:11.506264Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:51:15.580Z"}}], "cna": {"title": "Zitadel Bypass Second Authentication Factor", "source": {"advisory": "GHSA-cfjq-28r2-4jv5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"status": "affected", "version": ">= 4.0.0-rc.1, < 4.6.0"}, {"status": "affected", "version": ">= 3.0.0-rc.1, < 3.4.3"}, {"status": "affected", "version": ">= 2.55.0, < 2.71.18"}, {"status": "affected", "version": ">= 2.54.3, <= 2.54.10"}, {"status": "affected", "version": ">= 2.53.6, <= 2.53.9"}]}], "references": [{"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5", "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b", "name": "https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-308", "description": "CWE-308: Use of Single-factor Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-29T20:42:41.527Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64103", "state": "PUBLISHED", "dateUpdated": "2025-10-30T14:51:19.189Z", "dateReserved": "2025-10-27T15:26:14.127Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-29T18:43:46.934Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "zitadel", "vendor": "zitadel", "versions": [{"status": "affected", "version": ">= 4.0.0-rc.1, < 4.6.0"}, {"status": "affected", "version": ">= 3.0.0-rc.1, < 3.4.3"}, {"status": "affected", "version": ">= 2.55.0, < 2.71.18"}, {"status": "affected", "version": ">= 2.54.3, <= 2.54.10"}, {"status": "affected", "version": ">= 2.53.6, <= 2.53.9"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "98F3C323-CBEA-4E27-92F2-6CB4976186A3", "versionEndIncluding": "2.53.9", "versionStartIncluding": "2.53.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "19218EA3-8DE3-4182-8109-3B87839092D1", "versionEndIncluding": "2.54.10", "versionStartIncluding": "2.54.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DF8B5A2-B574-4E0E-B6A6-6D08F2FB9300", "versionEndExcluding": "2.71.18", "versionStartIncluding": "2.55.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "71F16C15-7BC0-48BF-94CA-A0675AE8144E", "versionEndExcluding": "3.4.3", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EBBE21CE-7517-4843-AD68-281A0254BC26", "versionEndExcluding": "4.6.0", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18."}, {"lang": "es", "value": "A partir de 2.53.6, 2.54.3 y 2.55.0, Zitadel solo requer\u00eda autenticaci\u00f3n multifactor en caso de que la pol\u00edtica de inicio de sesi\u00f3n hubiera habilitado requireMFA o requireMFAForLocalUsers. Si un usuario hab\u00eda configurado MFA sin este requisito, Zitadel considerar\u00eda las sesiones autenticadas de un solo factor como v\u00e1lidas tambi\u00e9n y no requerir\u00eda m\u00faltiples factores. Omitir los segundos factores de autenticaci\u00f3n debilita la autenticaci\u00f3n multifactor y permite a los atacantes omitir el factor m\u00e1s seguro. Un atacante puede apuntar solo al c\u00f3digo TOTP, de solo seis d\u00edgitos, omitiendo la verificaci\u00f3n de contrase\u00f1a por completo y potencialmente comprometiendo cuentas con 2FA habilitado. Esta vulnerabilidad se corrige en 4.6.0, 3.4.3 y 2.71.18."}], "id": "CVE-2025-64103", "lastModified": "2026-10-19T13:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64103", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-30T14:51:11.506264Z", "version": "2.0.3"}}]}, "published": "2025-10-29T19:15:39.067", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-308"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-30T14:37:30.703741+00:00", "updated": "2025-10-30T14:37:30.703766+00:00", "vendors": ["zitadel", "zitadel$PRODUCT$zitadel"]}