CVE-2025-64102 is a critical (CVSS 9.8) flaw in ZITADEL, the open source identity platform. Online brute force protection was not enforced on OTP, TOTP and password checks. The fix is in ZITADEL 4.6.0, 3.4.3 and 2.71.18, so upgrade your major line and review your lockout settings.
What's affected
The record and the GitHub advisory (GHSA-xrw9-r35x-x878) agree on the fixed releases: 4.6.0, 3.4.3 and 2.71.18. The advisory gives these affected ranges, release candidates included:
- 4.x: 4.0.0 to 4.4.0
- 3.x: 3.0.0 to 3.4.2
- 2.x: 2.0.0 to 2.71.17
The advisory also notes that the Go module github.com/zitadel/zitadel/v2 is affected below 2.71.18. If you embed ZITADEL code rather than run the released binary or image, check your module version too.
How to check if you're exposed
Find out which ZITADEL release you run. For a container deployment, the image tag is the quickest answer:
docker ps --format '{{.Names}} {{.Image}}'
kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep -i zitadel
If you build from Go modules, list the version your project resolves:
go list -m all | grep -i zitadel
Then compare the result with the affected ranges above. Also check whether the password lockout policy ("Password maximum attempts") is set on your instance and organizations. The advisory says the lockout mechanism is not enabled by default. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest if ZITADEL is part of a Go build.
What to do now
- Upgrade to ZITADEL 4.6.0, 3.4.3 or 2.71.18 or later, depending on the major line you run.
- After upgrading, expect the new default behavior the advisory describes: a "tar pit" that delays responses after repeated failed attempts, and lockout enforced on all OTP, TOTP and password checks.
- Until you can upgrade, enable the optional lockout policy and add stricter rate limits in front of the login endpoints. The advisory offers this only as a possible mitigation and recommends updating.
- Review authentication logs for bursts of failed OTP, TOTP or password attempts against single accounts, and reset credentials for any account that shows suspicious success after many failures.
- Record the upgrade in your inventory so you can show which instances are on a patched line.
Why it matters
The weakness class is CWE-307, improper restriction of excessive authentication attempts. A six digit code has only a million possible values. That is fine if the server slows or blocks guessing, and weak if it does not. Per the advisory, ZITADEL had a lockout option that was off by default, could lock out a legitimate user if turned on, and was not fully carried into the newer resource based APIs.
The advisory credits a scheduled penetration test by zentrust partners GmbH for the finding. The fix enforces lockout on every check and adds a progressive delay by default, so protection no longer depends on an administrator knowing to switch it on. The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and the advisory does not report exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is lockout enough on its own?
The advisory describes lockout as an optional mitigation that is not enabled by default and can cause a denial of service for a user. The recommended fix is to upgrade, which also adds the default response delay.
Is CVE-2025-64102 exploited in the wild?
Not according to the record. It is not marked as a CISA Known Exploited Vulnerability, and the advisory does not mention exploitation.
Sources
Last reviewed: 18 October 2026.
