Identity Management System Vulnerability in Zitadel

CVE-2024-41952

Summary

Zitadel, an open-source identity management system, has a vulnerability stemming from an implementation flaw related to the 'Ignoring unknown usernames' security setting. When enabled, this feature is intended to prevent username enumeration attacks by masking the existence of user accounts. However, due to a database call optimization change, the system may incorrectly disclose whether a username exists, stating 'object not found' instead of the intended generic error message. This flaw allows malicious actors to infer the existence of accounts within Zitadel, thus reducing the effectiveness of the security measure. The issue has been resolved in versions 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8, and 2.53.9. For detailed information on the fixes, refer to the provided GitHub links.

References