Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2024-32868

ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

Description

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

zitadel zitadel

  • < 2.50.0affected

References