CVE-2025-64103

{
  "id": "CVE-2025-64103",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-29T19:15:39.067",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18."
    },
    {
      "lang": "es",
      "value": "A partir de 2.53.6, 2.54.3 y 2.55.0, Zitadel solo requería autenticación multifactor en caso de que la política de inicio de sesión hubiera habilitado requireMFA o requireMFAForLocalUsers. Si un usuario había configurado MFA sin este requisito, Zitadel consideraría las sesiones autenticadas de un solo factor como válidas también y no requeriría múltiples factores. Omitir los segundos factores de autenticación debilita la autenticación multifactor y permite a los atacantes omitir el factor más seguro. Un atacante puede apuntar solo al código TOTP, de solo seis dígitos, omitiendo la verificación de contraseña por completo y potencialmente comprometiendo cuentas con 2FA habilitado. Esta vulnerabilidad se corrige en 4.6.0, 3.4.3 y 2.71.18."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zitadel",
          "product": "zitadel",
          "versions": [
            {
              "version": ">= 4.0.0-rc.1, < 4.6.0",
              "status": "affected"
            },
            {
              "version": ">= 3.0.0-rc.1, < 3.4.3",
              "status": "affected"
            },
            {
              "version": ">= 2.55.0, < 2.71.18",
              "status": "affected"
            },
            {
              "version": ">= 2.54.3, <= 2.54.10",
              "status": "affected"
            },
            {
              "version": ">= 2.53.6, <= 2.53.9",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-30T14:51:11.506264Z",
          "id": "CVE-2025-64103",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-308"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.53.6",
              "versionEndIncluding": "2.53.9",
              "matchCriteriaId": "98F3C323-CBEA-4E27-92F2-6CB4976186A3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.54.3",
              "versionEndIncluding": "2.54.10",
              "matchCriteriaId": "19218EA3-8DE3-4182-8109-3B87839092D1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.55.0",
              "versionEndExcluding": "2.71.18",
              "matchCriteriaId": "0DF8B5A2-B574-4E0E-B6A6-6D08F2FB9300"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.0.0",
              "versionEndExcluding": "3.4.3",
              "matchCriteriaId": "71F16C15-7BC0-48BF-94CA-A0675AE8144E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.6.0",
              "matchCriteriaId": "EBBE21CE-7517-4843-AD68-281A0254BC26"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}