CVE-2026-23511

Published: Jan 15, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6.

Affected (3)

Products: Zitadel: Zitadel

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Zitadel Zitadel	From 2.0.0 to 2.71.19
Zitadel Zitadel	From 3.0.0 to 3.4.6
Zitadel Zitadel	From 4.0.0 to 4.9.1

Related CWEs

Observable Response Discrepancy

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

References (5)

https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2

Source: security-advisories@github.com

Patch

https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d

Source: security-advisories@github.com

Patch

https://github.com/zitadel/zitadel/releases/tag/v3.4.6

Source: security-advisories@github.com

Release Notes

https://github.com/zitadel/zitadel/releases/tag/v4.9.1

Source: security-advisories@github.com

Release Notes

https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r

Source: security-advisories@github.com

Third Party Advisory

Timeline

No history available yet.