CNNVD-202510-3959 Information
CNNVD ID
CNNVD-202510-3959
Related CVE
- CNNVD Published: 2025-10-29
Description (Chinese)
ZITADEL是瑞士ZITADEL开源的一个 Auth0、Firebase Auth、AWS Cognito 以及为容器和无服务器时代构建的 Keycloak 的现代开源替代方案。 ZITADEL 4.6.0之前版本、3.4.3之前版本和2.71.18之前版本存在安全漏洞，该漏洞源于未默认启用锁定机制，可能导致OTP、TOTP和密码遭受在线暴力破解攻击。
Description (English)
ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito and Keycloak built in the age of packagings and servers. There is a security loophole in previous versions of ZITADEL 4.6.0, 3.4.3 and 2.71.18, which stems from the non-consensual activation of locking mechanisms, which may result in online violent decomposition attacks on OTP, TOTP and passwords.
Hazard Level
Medium
Vulnerability Type
其他
Affected Vendor
ZITADEL
Published
2025-10-29
Last Modified
2026-02-24
References
https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878 https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a https://access.redhat.com/security/cve/cve-2025-64102
Patch
https://github.com/zitadel/zitadel/releases
Share on: