CVE-2024-32868CWE-297CWE-307

ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

Medium · published April 25, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00456 · 38.6th percentile
Weaknesses
CWE-297 · Improper Validation of Certificate with Host Mismatch; CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2024-04-25T23:53Z
EPSS history
Timeline
  • 25 APR 23:53Z
    ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass
    cvelistv5