Riskcovery

CVE-2024-32868

ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

State
Published
Severity
6.5 Medium
Published
Apr 25, 2024
Updated
Aug 5, 2024
Reserved
Apr 19, 2024

Read the record on cve.org

Description

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NGitHub_M

Weaknesses

  • CWE-307 Improper Restriction of Excessive Authentication Attempts
  • CWE-297 Improper Validation of Certificate with Host Mismatch

Affected Products

ProductVersions
zitadelzitadel
  • < 2.50.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.