Threats tagged 'ghsa-cfjq-28r2-4jv5'

A vulnerability in Zitadel's token verification allowed sessions to be marked as authenticated after only one factor was verified, bypassing the intended second authentication factor. This affects Zitadel versions 4.0.0 to 4.5.0, 3.0.0 to 3.4.2, and several 2.x versions up to but not including 2.71.18. The flaw weakens multifactor authentication by permitting attackers to bypass password verification and authenticate using only the TOTP code. The issue has been fixed in Zitadel versions 4.6.0, 3.4.3, and 2.71.18 and later. Users are advised to upgrade to these patched versions to mitigate the risk.