CVE-2025-64103: zitadel from 2.53.6 (inclusive), through 2.53.9 (inclusive), from 2.54.3 (inclusive), through 2.54.10 (inclusive)…

Affected technology

zitadel · from 2.53.6 (inclusive), through 2.53.9 (inclusive)
zitadel

zitadel · from 2.54.3 (inclusive), through 2.54.10 (inclusive)
zitadel

zitadel · from 2.55.0 (inclusive), before 2.71.18 (exclusive)
zitadel

zitadel · from 3.0.0 (inclusive), before 3.4.3 (exclusive)
zitadel

zitadel · from 4.0.0 (inclusive), before 4.6.0 (exclusive)
zitadel

zitadel · >= 4.0.0-rc.1, < 4.6.0, >= 3.0.0-rc.1, < 3.4.3, >= 2.55.0, < 2.71.18, >= 2.54.3, <= 2.54.10, >= 2.53.6, <= 2.53.9
zitadel

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.