Zitadel CVE-2025-64102

Default-configuration Zitadel instances prior to 4.6.0/3.4.3/2.71.18 are exposed because the lockout ('Password maximum attempts') policy is NOT enabled by default, leaving OTP, TOTP, and password checks without failed-attempt throttling; the newer resource-based APIs lacked the mitigation even where lockout was configured. Exploitation requires network reach to the authentication endpoints and a known target username (and, for second-factor brute force, having passed the preceding factor - hence PR:L). Limiting factors: brute-forcing time-limited 6-digit TOTP/OTP codes is probabilistic rather than guaranteed (AT:P), success is far easier against weak passwords, and administrators who had enabled the optional lockout gained partial protection (at the cost of a DoS risk to the targeted user).

This is a genuine but second-tier priority. The vendor CVSS 4.0 score is 7.7 (High) with AV:N/AC:L/AT:P/PR:L/UI:N and full VC:H/VI:H/VA:H impact, reflecting that a successful brute-force yields complete takeover of the victim account. However, several signals temper real-world urgency and partly conflict. The AT:P metric (attack requirements present) and PR:L both signal that exploitation is not trivial drive-by abuse: online brute-forcing of TOTP/OTP codes is probabilistic against short-lived 6-digit values, and the attacker generally needs to already be at the relevant authentication step (e.g. know a username, or have passed the first factor for second-factor brute force), which is why PR:L rather than PR:N was assigned. No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with a flaw found during a scheduled penetration test (zentrust partners GmbH) rather than discovered in the wild. The 'Denial Of Service' tag is somewhat misleading: the core defect is CWE-307 (improper restriction of excessive authentication attempts), and DoS is only a side effect of the OPTIONAL lockout mitigation, not the primary threat. Net: real and worth patching promptly for any internet-exposed Zitadel instance (default config has NO lockout), but not an emergency absent exploitation evidence.

An attacker who knows or guesses a target username repeatedly submits password, TOTP, or email/SMS OTP guesses against an internet-facing Zitadel instance that (by default) has no lockout policy enabled. Because failed-attempt throttling was not enforced - and was missing entirely from the newer resource-based APIs - the attacker can eventually guess a valid factor and impersonate the user. No public exploit code is known; success depends on weak secrets and sustained automated guessing against the exposed auth endpoints.