Threats tagged 'ghsa-xrw9-r35x-x878'

Zitadel versions 2.0.0 to 2.71.17, 3.0.0 to 3.4.2, and 4.0.0 to 4.4.0 are vulnerable to brute-force attacks on OTP, TOTP, and passwords. The vulnerability allows attackers to impersonate users by repeatedly attempting authentication factors. Although Zitadel supports a lockout mechanism to prevent brute-force attacks, it is not enabled by default and can cause denial of service if activated. The lockout policy was also not fully implemented in newer resource-based APIs. The issue has been fixed in versions 2.71.18, 3.4.3, and 4.6.0 by enforcing lockout policies and introducing a delay mechanism to slow down repeated failed attempts.