Zitadel CVE-2025-64103

Exploitation requires a specific, named combination: (1) the deployment uses the Zitadel v2/v2-beta session API directly or the new login UI; (2) the login policy has NEITHER requireMFA NOR requireMFAForLocalUsers enabled; and (3) the targeted user has self-enrolled a second factor (TOTP, U2F, OTP-SMS, or OTP-Email) under that non-enforcing policy. Given those, an attacker needs only ONE valid factor - critically, the standalone 6-digit TOTP code, which can be brute-forced, bypassing password verification entirely. Limiting factors that reduce real-world exposure: the flaw does not apply where the login policy already forces MFA, does not apply to machine users (no interactive login), does not affect legacy login flows outside the session API, and still requires the attacker to possess or guess one factor (PR:L), so it is not usable against an attacker with zero credentials.

This is a genuine authentication-bypass priority for affected Zitadel deployments, not a CVSS-inflated non-issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7/High) is internally consistent with the advisory: network-reachable session API, low complexity, and PR:L reflecting that the attacker must present one legitimate factor rather than being fully unauthenticated. The core danger is that Zitadel prematurely marked a single-factor session as fully authenticated when a user had voluntarily enrolled MFA but the login policy did not set requireMFA/requireMFAForLocalUsers - so an attacker can satisfy MFA with just the 6-digit TOTP (or just the password) and defeat the second factor entirely. No EPSS score, CISA KEV entry, or public exploit was provided, so exploitation is: no public exploit identified at time of analysis - the flaw was found during a scheduled penetration test by zentrust partners, indicating it was responsibly disclosed rather than exploited in the wild. The absence of KEV/EPSS data should be treated as missing signal, not as evidence of low risk: the 6-digit TOTP-only path is realistically brute-forceable, which materially raises practical exploitability for any operator who relied on self-service MFA enrollment without enforcing a policy.

An attacker who holds one of a victim's authentication factors - for example a phished/reused password, or alternatively just the ability to brute-force the account's 6-digit TOTP - creates a session through Zitadel's v2 session API (or the new login UI). Because the login policy does not force MFA, Zitadel issues a fully-valid session token after only that single factor, and the attacker uses it as a Bearer token to access the account despite its 2FA being enabled. No public exploit code is known, but the attack requires no special tooling.