CVE-2023-47111High· 7.3▾ TwilightZITADEL race condition in lockout policy execution
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum.
Exceeding the limit, will lock the user and prevent further authentication.
In the affected implementation it was possible for an attacker to start multiple parallel password checks, giving him the possibility to try out more combinations than configured in the Lockout Policy.
2.x versions are fixed on >= 2.40.5 2.38.x versions are fixed on >= 2.38.3
There is no workaround since a patch is already available.
None
If you have any questions or comments about this advisory, please email us at [email protected]
github.com/zitadel/zitadel >= 2.39.0, < 2.40.5github.com/zitadel/zitadel < 2.38.3Upgrade to a patched release:
github.com/zitadel/zitadel 2.40.5github.com/zitadel/zitadel 2.38.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56668High· 8.1ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
CVE-2026-76081Medium· 5.5ZITADEL is an open source identity management platform
CVE-2023-22492Medium· 5.9Zitadel RefreshToken invalidation vulnerability
CVE-2023-49097High· 8.1ZITADEL Account Takeover via Malicious Host Header Injection
CVE-2026-56665Medium· 4.2ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
CVE-2026-56664Medium· 4.2ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider