Executive Summary

This vulnerability in Zitadel, an open-source identity infrastructure software, allows an attacker to perform an online brute-force attack on OTP, TOTP, and passwords. Although Zitadel has a lockout mechanism to prevent such attacks, it is not enabled by default and can cause denial of service if enabled. Additionally, the mitigation is not fully implemented in newer resource-based APIs. The issue is fixed in versions 4.6.0, 3.4.3, and 2.71.18.

Useful 0 Not Useful 0

Impact Analysis

An attacker could repeatedly attempt to guess OTPs, TOTPs, or passwords, potentially gaining unauthorized access to accounts. If the lockout mechanism is enabled to prevent this, it could cause denial of service for legitimate users by locking their accounts. This can lead to compromised security and service disruption.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Zitadel to version 4.6.0, 3.4.3, or 2.71.18 or later, where the issue is fixed. Additionally, consider enabling the lockout mechanism to prevent online brute-force attacks on OTP, TOTP, and passwords, but be aware that enabling this mechanism may cause denial of service for the corresponding user. Note that mitigation strategies may not be fully implemented in recent resource-based APIs, so upgrading is the most reliable step.

Useful 0 Not Useful 0