What is CVE-2025-64103?

CVE-2025-64103 is a critical-severity vulnerability in Zitadel, classified under Improper Authentication. CVSS score: 9.8/10. Published 2025-10-29.

How severe is CVE-2025-64103?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Zitadel

CVE-2025-64103

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would…

Vulnerability class: Broken Authentication

EPSS: 0.003 (25.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Zitadel — versions >= 4.0.0-rc.1, < 4.6.0, >= 3.0.0-rc.1, < 3.4.3, >= 2.55.0, < 2.71.18

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-64103?: CVE-2025-64103 is a critical-severity vulnerability in Zitadel, classified under Improper Authentication. CVSS score: 9.8/10. Published 2025-10-29.
How severe is CVE-2025-64103?: Critical severity. CVSS v3 base score is 9.8 out of 10.