User Enumeration Vulnerability in Zitadel Identity Infrastructure Software

CVE-2025-31124

Summary

Zitadel, an open-source identity infrastructure solution, is affected by a vulnerability that allows for user enumeration. When administrators enable the 'Ignoring unknown usernames' setting to mitigate attacks aiming at username guessing, the system still normalizes usernames. This leads to unintentional disclosure of a user's existence by allowing attackers to infer valid usernames based on the login responses. Instead of properly denying existence as intended, legitimate user prompts are shown even when credentials do not exist, indicating a flaw in the user verification process. The issue has been addressed in multiple updated versions of the software.

References