PT-2026-39289 · Zitadel · Zitadel

Proscan-One · Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-44671

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.71.11 through 2.71.19 ZITADEL versions 3.1.0 through 3.4.9 ZITADEL versions 4.0.0 through 4.14.0

Description An issue exists in the LDAP identity provider implementation where user-provided usernames are not properly escaped before being included in LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process. By using LDAP metacharacters such as *, (, and ), an attacker can execute blind LDAP injection. This technique enables the systematic enumeration of valid usernames and the extraction of sensitive attribute data from the connected LDAP directory by analyzing the success or failure responses. This does not allow for a full authentication bypass.

Recommendations Update versions 2.71.11 through 2.71.19 to 3.4.10. Update versions 3.1.0 through 3.4.9 to 3.4.10. Update versions 4.0.0 through 4.14.0 to 4.15.0. Ensure the LDAP directory has strict access controls to limit the scope of information disclosure.

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-44671

GHSA-RXVX-HHPJ-Q6PX

Affected Products

Zitadel

References · 8

• https://github.com/zitadel/zitadel/security/advisories/GHSA-rxvx-hhpj-q6px · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44671 · Security Note
• https://osv.dev/vulnerability/GHSA-rxvx-hhpj-q6px · Vendor Advisory
• https://github.com/zitadel/zitadel/releases/tag/v3.4.10 · Note
• https://github.com/zitadel/zitadel/releases/tag/v4.15.0 · Note
• https://github.com/zitadel/zitadel · Note
• https://t.me/CVEtracker/53849 · Telegram Post
• https://twitter.com/CVEnew/status/2055074214109978864 · Twitter Post