-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided patch commit b284f8474eed0cba531905101619e7ae7963156b clearly indicates that the root cause of the vulnerability was in the checkAuthentication function located in internal/authz/repository/eventsourcing/eventstore/token_verifier.go. The vulnerability description states that Zitadel would prematurely mark sessions as authenticated with only one factor verified, even if a second factor was configured by the user, unless a policy enforced MFA. The code changes directly address this flaw. The original code only checked domain.RequiresMFA, which evaluated policy settings. The patched code introduces a new condition, domain.Has2FA(allowedFactors), which checks if the user has any second-factor authentication methods set up. By adding this check with an OR condition, the logic now correctly enforces MFA for any user who has it configured, regardless of whether a policy mandates it. The other modified files, such as those for database queries and domain logic, were changed to support this primary fix by providing the necessary data (e.g., user's configured factors) to the checkAuthentication function. Therefore, checkAuthentication is the precise location of the vulnerable logic and the function that would be in the call stack during an exploit attempt.
eventstore.(*TokenVerifierRepo).checkAuthenticationinternal/authz/repository/eventsourcing/eventstore/token_verifier.go
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel/v2 | go | >= 2.53.6, <= 2.53.9 | |
| github.com/zitadel/zitadel/v2 | go | >= 2.54.3, <= 2.54.10 | |
| github.com/zitadel/zitadel/v2 | go | >= 2.55.0, <= 2.71.17 | 2.71.18 |
Ongoing coverage of React2Shell