Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing lockout mechanisms for (T)OTP verification. The release notes for v2.50.0 explicitly mention adding 'option to limit (T)OTP checks' (commit a282ac0), indicating previous versions lacked this protection. The CWE-307 (Excessive Auth Attempts) confirms this pattern. Core authentication functions handling TOTP/OTP validation would be responsible for attempt tracking and lockout enforcement. While exact function names aren't provided in public sources, the standard pattern in authentication systems suggests functions named VerifyTOTPCode/VerifyOTPCode in the OTP handling module would be the logical location of the missing security controls.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | < 2.50.0 | 2.50.0 |
