Zitadel allows brute-forcing authentication factors

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-64102 · Microsoft / collected KEV context

EUVD-2025-36697

GHSA-xrw9-r35x-x878

GO-2025-4085

cve-program · CVE-2025-64102

• https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878
• https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a

euvd · EUVD-2025-36697

• https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878
• https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a

nvd · CVE-2025-64102

• https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a
• https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878

osv · GHSA-xrw9-r35x-x878

• https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878
• https://nvd.nist.gov/vuln/detail/CVE-2025-64102
• https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a
• https://github.com/zitadel/zitadel
• https://pkg.go.dev/vuln/GO-2025-4085

osv · GO-2025-4085

• https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878
• https://nvd.nist.gov/vuln/detail/CVE-2025-64102
• https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a

No related operational record is retained in the current change model.