Vulnerability Discovery
During an assessment of a Zitadel deployment, Cythera uncovered a critical flaw now tracked as CVE-2023-46238. Building on that discovery, we performed additional research while preparing for his presentation at CHCon 2023 and identified another significant issue related to Zitadel’s password lockout policy.
Zitadel includes a security feature designed to lock out user accounts after a certain number of failed login attempts. However, we found that this feature could be bypassed due to a race condition—a timing issue that allows multiple login attempts to be processed before the lockout is enforced.
By sending concurrent login requests to the /ui/login/password endpoint, an attacker could exploit the window of delay before the lockout trigger activates. This meant that the intended rate-limiting protections were ineffective when requests were fired in quick succession.
The attack required no advanced tools or low-level packet manipulation. Readily available applications like Burp Suite Intruder or Turbo Intruder were enough to simulate the attack. A proof-of-concept was developed, which:-
- Automatically generated incorrect password attempts
- Sent them rapidly in parallel to the login endpoint
Interpreted server responses to distinguish between valid, invalid, locked-out, or successful login states using common response markers like:
- “Password is invalid”
- “User is locked”
- HTTP 302 (redirect) responses indicating login success
The Results
The result demonstrated that Zitadel’s lockout mechanism could be bypassed, significantly increasing the risk of brute-force attacks.
