UpHeron
All vulnerabilities

Servers and applications

CVE-2023-47111

Race condition in lockout policy execution

Severity
Low 3.7
Published
8 Nov 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.38.3, 2.40.4, 2.40.5
Also known as
GHSA-7h8m-vrxx-vr4m
Sources
NVD, Project advisories (GitHub)

Description

ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit, will lock the user and prevent further authentication. In the affected implementation it was…

Affected software

SoftwareAffected versions
ZITADELServers and applications · cpe:a:zitadel:zitadel
  • Every version before 2.38.3
  • From 2.39.0 before 2.40.5
ZITADELServers and applications · github:zitadel/zitadel
  • Every version before 2.38.3
  • From 2.39.0 before 2.40.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-47111
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-47111
  • GitHub Advisory Database https://github.com/advisories/GHSA-7h8m-vrxx-vr4m
  • github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-7h8m-vrxx-vr4m