Cloudanix VulnDB

CVE-2025-64103

None

Zitadel May Bypass Second Authentication Factor

CVSS

—

EPSS

0.4%

Published

Oct 29, 2025

CISA due date

—

The record

A vulnerability in Zitadel's token verification prematurely marked sessions as authenticated when only one factor was verified.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/zitadel/zitadel 0 No fix
Go github.com/zitadel/zitadel 0 1.80.0-v2.20.0.20251029091250-b284f8474eed
Go github.com/zitadel/zitadel/v2 2.53.6 No fix
Go github.com/zitadel/zitadel/v2 2.54.3 No fix
Go github.com/zitadel/zitadel/v2 2.55.0 2.71.18
go github.com/zitadel/zitadel/v2 2.53.6 No fix
go github.com/zitadel/zitadel/v2 2.54.3 No fix
go github.com/zitadel/zitadel/v2 2.55.0 2.71.18
openSUSE:Tumbleweed govulncheck-vulndb 0 0.0.20251105T184115-1.1

Related vulnerabilities