Zitadel Identity Infrastructure Software User Enumeration Vulnerability

A user enumeration vulnerability has been identified in Zitadel, an open-source identity infrastructure software. When the 'Ignoring unknown usernames' setting is enabled, Zitadel normalizes usernames during the login process. This normalization inadvertently discloses whether a username exists, despite the setting's intention to obscure such information. The vulnerability is present in Zitadel versions prior to 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.

Impact

Exploitation of this vulnerability allows for username enumeration, where an attacker can determine the existence of specific usernames within the Zitadel system.

Remediation

Users are advised to update Zitadel to version 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, or 2.63.9.