ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| zitadel | zitadel | affected |
|
No data.
No data.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-1144 | ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0. |
 Github GHSA |
GHSA-7j7j-66cv-m239 | ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 08 Jan 2025 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Zitadel
Zitadel zitadel |
|
| CPEs | cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Zitadel
Zitadel zitadel |
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-08-05T16:54:00.249Z
Reserved: 2024-04-19T14:07:11.229Z
Link: CVE-2024-32868
Vulnrichment
Updated: 2024-08-02T02:20:35.643Z
NVD
Status : Analyzed
Published: 2024-04-26T00:15:08.753
Modified: 2025-01-08T18:21:50.550
Link: CVE-2024-32868
Redhat
No data.
OpenCVE Enrichment
No data.