Critical · published October 29, 2025
⚡ An online brute-force attack could be as easy as pie! Before versions 4.6.0, 3.4.3, and 2.71.18, Zitadel’s OTP and password protections left the door ajar for attackers! 🔓 Think of it like a hotel lobby where anyone can try to guess the keycode to the safe. If the hotel doesn't lock out the intruder after a few incorrect tries, they could whip up a winning combination by sheer persistence! An attacker could repeatedly attempt to guess user credentials, potentially locking users out or gaining unauthorized access. This means critical user data could be at risk, leading to a damaging denial of service or even a full account takeover!
Think of it like a hotel lobby where anyone can try to guess the keycode to the safe. If the hotel doesn't lock out the intruder after a few incorrect tries, they could whip up a winning combination by sheer persistence! This vulnerability allows attackers to exploit the authentication process by brute-forcing OTPs and passwords, as the lockout mechanism that should prevent such attacks is not enabled by default in older Zitadel versions.
An attacker could repeatedly attempt to guess user credentials, potentially locking users out or gaining unauthorized access. This means critical user data could be at risk, leading to a damaging denial of service or even a full account takeover! Upgrade to Zitadel versions 4.6.0, 3.4.3, or 2.71.18 immediately to secure your authentication processes. Additionally, be sure to enable the lockout mechanism to bolster protection against brute-force attempts. You've got this! Following these steps will level up your security game and help protect your users! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| zitadel/zitadel | < 2.71.18 | 2.71.18 |
| zitadel/zitadel | ≥ 3.0.0, < 3.4.3 | 3.4.3 |
| zitadel/zitadel | ≥ 4.0.0, < 4.6.0 | 4.6.0 |