CVE-2025-31124

MEDIUM EPSS 36.1%
Published Mar 31, 20251y ago · Modified Jun 17, 20261w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Mar 31, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
36.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 3

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-203
CWE-204

Affected Products 9

VendorProductVersionRange
zitadelzitadel* <2.63.9
zitadelzitadel*≥2.64.0  –  <2.64.6
zitadelzitadel*≥2.65.0  –  <2.65.7
zitadelzitadel*≥2.66.0  –  <2.66.16
zitadelzitadel*≥2.67.0  –  <2.67.13
zitadelzitadel*≥2.68.0  –  <2.68.9
zitadelzitadel*≥2.69.0  –  <2.69.9
zitadelzitadel*≥2.70.0  –  <2.70.8
zitadelzitadel*≥2.71.0  –  <2.71.6

References 11

  • github.com https://github.com/zitadel/zitadel/commit/14de8ecac2afafee4975ed7ac26f3ca4a2b0f82c
    Patch
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.63.9
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.64.6
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.65.7
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.66.16
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.67.13
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.68.9
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.69.9
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.70.8
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.71.6
    Release Notes
  • github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-67m4-8g4w-633q
    Vendor Advisory

Remediation

  • github.com https://github.com/zitadel/zitadel/commit/14de8ecac2afafee4975ed7ac26f3ca4a2b0f82c
    Patch