CVE-2026-23511

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23511", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T18:22:43.979Z", "datePublished": "2026-01-15T19:09:06.154Z", "dateUpdated": "2026-01-15T19:56:24.164Z"}, "containers": {"cna": {"title": "ZITADEL has a user enumeration vulnerability in Login UIs", "problemTypes": [{"descriptions": [{"cweId": "CWE-204", "lang": "en", "description": "CWE-204: Observable Response Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r"}, {"name": "https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2"}, {"name": "https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d"}, {"name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.6"}, {"name": "https://github.com/zitadel/zitadel/releases/tag/v4.9.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/releases/tag/v4.9.1"}], "affected": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"version": ">= 4.0.0, < 4.9.1", "status": "affected"}, {"version": "< 3.4.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-15T19:09:06.154Z"}, "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6."}], "source": {"advisory": "GHSA-pvm5-9frx-264r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T19:56:17.482311Z", "id": "CVE-2026-23511", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T19:56:24.164Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23511", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-15T19:56:17.482311Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T19:56:21.421Z"}}], "cna": {"title": "ZITADEL has a user enumeration vulnerability in Login UIs", "source": {"advisory": "GHSA-pvm5-9frx-264r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.9.1"}, {"status": "affected", "version": "< 3.4.6"}]}], "references": [{"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r", "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2", "name": "https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d", "name": "https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.6", "name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zitadel/zitadel/releases/tag/v4.9.1", "name": "https://github.com/zitadel/zitadel/releases/tag/v4.9.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204: Observable Response Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-15T19:09:06.154Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23511", "state": "PUBLISHED", "dateUpdated": "2026-01-15T19:56:24.164Z", "dateReserved": "2026-01-13T18:22:43.979Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-15T19:09:06.154Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "zitadel", "vendor": "zitadel", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.9.1"}, {"status": "affected", "version": "< 3.4.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFFBAC9C-9A67-4AF4-985C-31DCC2F1311D", "versionEndIncluding": "2.71.19", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "35824976-F697-4F42-8224-C8CE077BAB46", "versionEndExcluding": "3.4.6", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1B68D0EF-0AB9-4429-AA04-8FED60B814C9", "versionEndExcluding": "4.9.1", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6."}, {"lang": "es", "value": "ZITADEL es una plataforma de gesti\u00f3n de identidad de c\u00f3digo abierto. Antes de 4.9.1 y 3.4.6, se ha descubierto una vulnerabilidad de enumeraci\u00f3n de usuarios en las interfaces de inicio de sesi\u00f3n de Zitadel. Un atacante no autenticado puede explotar esta falla para confirmar la existencia de cuentas de usuario v\u00e1lidas al iterar a trav\u00e9s de nombres de usuario y userIDs. Esta vulnerabilidad est\u00e1 corregida en 4.9.1 y 3.4.6."}], "id": "CVE-2026-23511", "lastModified": "2026-06-17T10:21:42.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23511", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-15T19:56:17.482311Z", "version": "2.0.3"}}]}, "published": "2026-01-15T20:16:05.167", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.6"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/zitadel/zitadel/releases/tag/v4.9.1"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:01:51.141945+00:00", "value": {"mitigation_remediation": ["Upgrade to ZITADEL 4.9.1 or 3.4.6, where the user\u2011enumeration logic has been removed.", "Restrict direct access to the login interfaces from untrusted networks, ensuring only internal or trusted IP ranges can reach them.", "Review authentication logs for patterns of repeated login attempts with varying usernames, and apply rate limiting or account lockout policies to mitigate automated enumeration."], "summary": {"action": "Patch", "impact": "User Enumeration"}, "threat_synthesis": {"affected_systems": "All installations of ZITADEL running a version prior to 4.9.1 or 3.4.6 are affected. The vulnerability exists in the login user interfaces of those releases according to the vendor\u2019s release notes and commit history.", "description_and_impact": "ZITADEL\u2019s login interfaces allow an unauthenticated attacker to determine whether a username or userID exists by observing differences in the system\u2019s responses. The flaw is a classic user\u2011enumeration weakness (CWE\u2011204) that can lead to targeted credential\u2011guessing attacks or social\u2011engineering attempts. The public CVSS score of 5.3 indicates a moderate severity, reflecting the lack of direct privilege escalation but the potential for privacy and attack\u2011surface amplification.", "risk_and_exploitability": "Because the flaw requires no authentication and can be triggered via the standard web login UI, it is highly accessible to any external party with internet access to the service. Exploitation is straightforward: a malicious actor cycles through likely usernames and conditions on the response timing or content to infer account existence. The EPSS score of less than 1% and its absence from the CISA KEV catalog suggest current exploitation rates are low, but the ease of the attack vector means the risk remains tangible for environments with exposed login portals."}}}}, "created": "2026-01-16T13:42:53.334125+00:00", "updated": "2026-04-18T06:15:15.861316+00:00", "vendors": ["zitadel", "zitadel$PRODUCT$zitadel"]}