UpHeron
All vulnerabilities

Servers and applications

CVE-2025-64103

Bypass Second Authentication Factor

Severity
High 8.7
Published
29 Oct 2025
Last changed
19 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.71.8, 2.71.18, 3.4.3, 4.6.0
Also known as
GHSA-cfjq-28r2-4jv5
Sources
NVD, Project advisories (GitHub)

Description

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor…

Affected software

SoftwareAffected versions
ZITADELServers and applications · cpe:a:zitadel:zitadel
  • From 2.53.6 up to 2.53.9
  • From 2.54.3 up to 2.54.10
  • From 2.55.0 before 2.71.18
  • From 3.0.0 before 3.4.3
  • From 4.0.0 before 4.6.0
ZITADELServers and applications · github:zitadel/zitadel
  • From 2.55.0 before 2.71.8
  • From 3.0.0 before 3.4.3
  • From 4.0.0 before 4.6.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-64103
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64103
  • GitHub Advisory Database https://github.com/advisories/GHSA-cfjq-28r2-4jv5
  • github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5