CVE-2026-23511

Katalog CVE

CVSS 5.3 · Medium EPSS 0,40%

Kerentanan Observable Response Discrepancy pada zitadel. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6.

Rincian

Terbit di NVD

15 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2 patch
• https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d patch
• https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r advisory pihak ketiga
• https://github.com/zitadel/zitadel/releases/tag/v3.4.6 release notes
• https://github.com/zitadel/zitadel/releases/tag/v4.9.1 release notes