PT-2026-3095 · Zitadel · Zitadel

Iam-Marco · Published 2026-01-14 · Updated 2026-01-26 · CVE-2026-23511

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 4.9.1 ZITADEL versions prior to 3.4.6

Description ZITADEL is an open source identity management platform. A user enumeration issue exists in the login interfaces. An unauthenticated attacker can determine the existence of valid user accounts by attempting different usernames and userIDs. The vulnerability is exploitable by iterating through usernames and userIDs.

Recommendations Update ZITADEL to version 4.9.1 or later. Update ZITADEL to version 3.4.6 or later.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-204

Related Identifiers

BDU:2026-00674

CVE-2026-23511

GHSA-PVM5-9FRX-264R

GO-2026-4319

SUSE-SU-2026:0292-1

Affected Products

Zitadel

References · 32

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23511.json · Exploit
• https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2 · Patch
• https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23511 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23511 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0292-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pvm5-9frx-264r · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00674 · Security Note
• https://osv.dev/vulnerability/GO-2026-4319 · Vendor Advisory
• https://github.com/zitadel/zitadel · Note
• https://github.com/zitadel/zitadel/commit/0bb00dd9fc4e5e965f8e14fa2161a5076f3c308d · Note
• https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r · Note
• https://github.com/zitadel/zitadel/releases/tag/v4.9.1 · Note
• https://github.com/zitadel/zitadel/releases/tag/v3.4.6 · Note
• https://suse.com/security/cve/CVE-2026-23520 · Note