PT-2026-3095

CVE-2026-23511

Published

2026-01-14

Updated

2026-07-30

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 4.9.1 ZITADEL versions prior to 3.4.6

Description ZITADEL is an open source identity management platform. A user enumeration issue exists in the login interfaces. An unauthenticated attacker can determine the existence of valid user accounts by attempting different usernames and userIDs. The vulnerability is exploitable by iterating through usernames and userIDs.

Recommendations Update ZITADEL to version 4.9.1 or later. Update ZITADEL to version 3.4.6 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Iam-Marco

Vendors

Affected products

Weakness enumeration

CWE-203: Observable Discrepancy

CWE-204: Observable Response Discrepancy