CVE-2024-32868

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0.

Published: Apr 26, 2024
Updated: May 4, 2025
CVE: CVE-2024-32868
GHSA: GHSA-7j7j-66cv-m239
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.1
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWEs:

CWE-287
CWE-297
CWE-307

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
github.com/zitadel/zitadel	-	2.50.0
zitadel / zitadel	-	2.50.0

https://github.com/zitadel/zitadel/releases/tag/v2.50.0
https://github.com/zitadel/zitadel/security/advisories/GHSA-7j7j-66cv-m239

Vulnerability Database

CVE-2024-32868

Deep Security Visibility Without the Complexity