CVE-2023-44399: ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting
Impact ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL.
Patches This bug has been patched in versions >2.27.2 beginning with 2.37.3 and 2.38.0
Workarounds None available we advise to updated if this is needed.
References None
Other sources
ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL. This bug has been patched in versions 2.37.3 and 2.38.0. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this ZITADEL vulnerability?
The vulnerability ID for this ZITADEL vulnerability is CVE-2023-44399.
What is the impact of this vulnerability?
This vulnerability allows attackers to bypass the "Ignoring unknown usernames" setting during the password reset flow in ZITADEL versions 2.37.2 and prior.
How can ZITADEL administrators mitigate this vulnerability?
ZITADEL administrators should update to version 2.37.3 or higher to remedy this vulnerability.
What is the severity of CVE-2023-44399?
The severity of CVE-2023-44399 is medium with a CVSS score of 5.3.
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The CWE ID for this vulnerability is CWE-640.