Skip to content
Fencer Vulns
medium 5.3

CVE-2025-31124 json

Zitadel allows User Enumeration by loginname attribute normalization

published 2025-03-31 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-8871

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.

Patch / fix

  • zitadel zitadel 2.63.9, 2.64.6, 2.65.7, 2.66.16, 2.67.13, 2.68.9, 2.69.9, 2.70.8, 2.71.6

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

  • zitadel zitadel

Classification

Weakness
  • CWE-203 Observable Discrepancy
  • CWE-204 Observable Response Discrepancy
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.