Critical · published October 29, 2025
⚡ Bypassing MFA is easier than you think! With Zitadel versions 2.53.6, 2.54.3, and 2.55.0, if the login policy isn't strict about requiring MFA, you might be leaving your accounts open for attack! 🔓 Think of it like a bank that only checks for a second key if you’ve specifically asked them to. If you don't ask for that extra verification, an attacker only needs to steal the single six-digit code to crack the vault! This vulnerability could allow an attacker to bypass the second factor of your multifactor authentication entirely. They can target just the TOTP code, effectively compromising accounts that thought they were extra secure. It’s like unlocking a safe with just a flimsy combination instead of requiring both a combination and a key!
Think of it like a bank that only checks for a second key if you’ve specifically asked them to. If you don't ask for that extra verification, an attacker only needs to steal the single six-digit code to crack the vault! Starting from certain versions, Zitadel only enforces multifactor authentication if specified in the login policy. This flaw allows single-factor authenticated sessions to be treated as valid, which can be exploited by attackers focusing solely on the TOTP code, bypassing password checks altogether.
This vulnerability could allow an attacker to bypass the second factor of your multifactor authentication entirely. They can target just the TOTP code, effectively compromising accounts that thought they were extra secure. It’s like unlocking a safe with just a flimsy combination instead of requiring both a combination and a key! Upgrade Zitadel to patched versions 4.6.0, 3.4.3, or 2.71.18 immediately. Review your login policies to ensure MFA is always required, and consider implementing additional security measures to protect TOTP codes from being intercepted. 🔒 You've got this! With these steps, you can reinforce your security and keep those pesky attackers at bay! 🏆
| Product | Versions | Fixed in |
|---|---|---|
| zitadel/zitadel | ≥ 2.53.6, ≤ 2.53.9 | — |
| zitadel/zitadel | ≥ 2.54.3, ≤ 2.54.10 | — |
| zitadel/zitadel | ≥ 2.55.0, < 2.71.18 | 2.71.18 |
| zitadel/zitadel | ≥ 3.0.0, < 3.4.3 | 3.4.3 |
| zitadel/zitadel | ≥ 4.0.0, < 4.6.0 | 4.6.0 |