CVE-2025-64103

A vulnerability in Zitadel's token verification prematurely marked sessions as authenticated when only one factor was verified.

Affected Versions

Systems using the session API (v2 beta and v2) directly or via the new login UI in the following versions are affected:

• 4.x: 4.0.0 to 4.5.0 (including RC versions)
• 3.x: 3.0.0 to 3.4.2 (including RC versions)
• 2.x: v2.53.6 to v2.53.9, v2.54.3 to v2.54.10, 2.55.0 to 2.71.17

Workarounds

The recommended solution is to update Zitadel to a patched version.

Questions

If you have any questions or comments about this advisory, please email us at [email protected]

Credits

This vulnerability was found by zentrust partners GmbH during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.
The full report will be made public after the complete review.

Zitadel provides an API for managing sessions, enabling custom login experiences in a dedicated UI or direct integration into applications. Session Tokens are issued for active sessions, which can be used as Bearer tokens to call the Zitadel API.

Starting from 2.55.0 (see other affected versions below), Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors.

Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled.

The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.

Kodem intelligence

The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring a configured second factor regardless of the login policies requireMFA or requireMFAForLocalUsers configuration.

4.x: Upgrade to >=4.6.0
3.x: Update to >=3.4.3
2.x: Update to >=2.71.18

1. What is CVE-2025-64103? CVE-2025-64103 is a high-severity improper authentication vulnerability in github.com/zitadel/zitadel/v2 (go), affecting versions >= 2.53.6, <= 2.53.9. It is fixed in 2.71.18, 1.80.0-v2.20.0.20251029091250-b284f8474eed. The application does not adequately verify the identity of a user, device, or process before granting access.
2. Which packages are affected by CVE-2025-64103?
   • github.com/zitadel/zitadel/v2 (go) (versions >= 2.53.6, <= 2.53.9)
   • github.com/zitadel/zitadel (go) (versions < 1.80.0-v2.20.0.20251029091250-b284f8474eed)
3. Is there a fix for CVE-2025-64103? Yes. CVE-2025-64103 is fixed in 2.71.18, 1.80.0-v2.20.0.20251029091250-b284f8474eed. Upgrade to this version or later.
4. Is CVE-2025-64103 exploitable, and should I be worried? Whether CVE-2025-64103 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-64103 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2025-64103?
   • Upgrade github.com/zitadel/zitadel/v2 to 2.71.18 or later
   • Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20251029091250-b284f8474eed or later