CVE-2025-31124: Zitadel allows User Enumeration by loginname attribute normalization
Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31124?
CVE-2025-31124 is categorized as a moderate severity vulnerability affecting Zitadel.
How can I fix CVE-2025-31124?
To fix CVE-2025-31124, enable the "Ignoring unknown usernames" setting in Zitadel's configuration.
What software versions are affected by CVE-2025-31124?
CVE-2025-31124 affects Zitadel versions between 2.63.9 and 2.71.5.
What type of attack does CVE-2025-31124 help mitigate?
CVE-2025-31124 helps mitigate attacks aimed at guessing or enumerating usernames.
Is there a specific configuration change required to address CVE-2025-31124?
Yes, enabling the "Ignoring unknown usernames" setting is required to address CVE-2025-31124.