PT-2025-13822 · Zitadel · Zitadel

Ivan-Jedek

·

Published

2025-03-31

·

Updated

2025-04-01

·

CVE-2025-31124

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Zitadel versions prior to 2.71.6 Zitadel versions prior to 2.70.8 Zitadel versions prior to 2.69.9 Zitadel versions prior to 2.68.9 Zitadel versions prior to 2.67.13 Zitadel versions prior to 2.66.16 Zitadel versions prior to 2.65.7 Zitadel versions prior to 2.64.6 Zitadel versions prior to 2.63.9
Description The issue concerns Zitadel, an open-source identity infrastructure software. A setting called "Ignoring unknown usernames" is intended to mitigate attacks that try to guess or enumerate usernames. However, due to a normalization process, the user's username existence could be disclosed, even when this setting is enabled. This occurs because the software shows the password prompt and reports "Username or Password invalid" for non-existent users, but the normalization of the username leads to the disclosure of the user's existence.
Recommendations Update to version 2.71.6 or later for the 2.71 branch. Update to version 2.70.8 or later for the 2.70 branch. Update to version 2.69.9 or later for the 2.69 branch. Update to version 2.68.9 or later for the 2.68 branch. Update to version 2.67.13 or later for the 2.67 branch. Update to version 2.66.16 or later for the 2.66 branch. Update to version 2.65.7 or later for the 2.65 branch. Update to version 2.64.6 or later for the 2.64 branch. Update to version 2.63.9 or later for the 2.63 branch.

Exploit

Fix

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-204CWE-200CWE-203

Related Identifiers

CVE-2025-31124
GHSA-67M4-8G4W-633Q

Affected Products

Zitadel