Medium
Zitadel allows User Enumeration by loginname attribute normalization
Type: advisorySources: OSV
Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-31124
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 16:32 UTC · Revision 1
Source evidence
Zitadel allows User Enumeration by loginname attribute normalization
core-osv · Original sourcePublished 31 Mar 2025, 19:38 UTC
Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.
osv:CVE-2025-31124
Complete source record
{
"id": "f43c59ca88335bf698d39b9b54f285e9089e1e56c818b4d7311963f3acbec211",
"url": "https://osv.dev/vulnerability/CVE-2025-31124",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Zitadel allows User Enumeration by loginname attribute normalization",
"summary": "Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called \"Ignoring unknown usernames\" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report \"Username or Password invalid\". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.",
"evidence": "osv:CVE-2025-31124",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-31124",
"aliases": [
"CVE-2025-31124",
"GHSA-67m4-8g4w-633q"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/zitadel/zitadel",
"type": "GIT",
"events": [
{
"introduced": "6210239ed5b8c92bc63d14d050137d2985e99bce"
},
{
"fixed": "90255ef7d8144a922a7357428cd317b95e41d17a"
},
{
"introduced": "710a929fad39a83169aa6797487ec7aefb8a4bd8"
},
{
"fixed": "9a614fa98d00cbb0127a6f374da5b00aa5dd12b6"
},
{
"introduced": "0aba000355d8f47c213c27b15f9eedc51241a1e3"
},
{
"fixed": "12ad907d3e36a0db735719c552e5135ae9e9f4bd"
},
{
"introduced": "e4ebac13aa662bc22574bedf7c33d7c028b783e1"
},
{
"fixed": "2a889a98533cff2e10cf108eb5c649e47d0dca78"
},
{
"introduced": "7dc23a749c03eb0c8a4aad30413c2d5b38f89ebc"
},
{
"fixed": "596567deb93499b22d2bb4a9be99cf8a557e4196"
},
{
"introduced": "a8e93a77c2ac0ea5733cad7f28c6ce96367724e6"
},
{
"fixed": "bb5db00e948bc8327aed99b2f82383ba46a7ca9c"
},
{
"introduced": "8b881f542b621c53e9ca5dd8bd6d62d2f90d4315"
},
{
"fixed": "314cc1495bd734afe78a2df6955df5ce8288de9a"
},
{
"introduced": "99c2247ecb36754619617df0c7266162bf37b877"
},
{
"fixed": "318761fd879c81ac1716bacfb2f84d8374efd92c"
},
{
"introduced": "732fc6040f69a6703af28151ce2b6cba6e430836"
},
{
"fixed": "4fde7822d8f728007fb0781690a4f8a6d47a1868"
},
{
"fixed": "14de8ecac2afafee4975ed7ac26f3ca4a2b0f82c"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "2.62.0"
},
{
"fixed": "2.63.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2.64.0-rc.1"
},
{
"fixed": "2.64.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2.65.0-rc.1"
},
{
"fixed": "2.65.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2.66.0-rc.1"
},
{
"fixed": "2.66.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2.67.0-rc.1"
},
{
"fixed": "2.67.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2.68.0-rc.1"
},
{
"fixed": "2.68.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2.69.0-rc.1"
},
{
"fixed": "2.69.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2.70.0-rc.1"
},
{
"fixed": "2.70.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2.71.0-rc.1"
},
{
"fixed": "2.71.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "14de8ecac2afafee4975ed7ac26f3ca4a2b0f82c"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "90255ef7d8144a922a7357428cd317b95e41d17a"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.63.9"
},
{
"range": [
{
"fixed": "9a614fa98d00cbb0127a6f374da5b00aa5dd12b6"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.64.6"
},
{
"range": [
{
"fixed": "12ad907d3e36a0db735719c552e5135ae9e9f4bd"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.65.7"
},
{
"range": [
{
"fixed": "2a889a98533cff2e10cf108eb5c649e47d0dca78"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.66.16"
},
{
"range": [
{
"fixed": "596567deb93499b22d2bb4a9be99cf8a557e4196"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.67.13"
},
{
"range": [
{
"fixed": "bb5db00e948bc8327aed99b2f82383ba46a7ca9c"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.68.9"
},
{
"range": [
{
"fixed": "314cc1495bd734afe78a2df6955df5ce8288de9a"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.69.9"
},
{
"range": [
{
"fixed": "318761fd879c81ac1716bacfb2f84d8374efd92c"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.70.8"
},
{
"range": [
{
"fixed": "4fde7822d8f728007fb0781690a4f8a6d47a1868"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.71.6"
}
]
}
}
],
"versions": [
"v2.63.8",
"v2.64.5",
"v2.65.6",
"v2.66.15",
"v2.67.12",
"v2.68.8",
"v2.69.8",
"v2.70.7",
"v2.71.5",
"v2.69.7",
"v2.68.7",
"v2.67.11",
"v2.66.14",
"v2.70.6",
"v2.71.4",
"v2.70.5",
"v2.66.13",
"v2.67.10",
"v2.68.6",
"v2.69.6",
"v2.71.3",
"v2.70.4",
"v2.66.12",
"v2.67.9",
"v2.68.5",
"v2.69.5",
"v2.71.2",
"v2.70.3",
"v2.71.1",
"v2.66.11",
"v2.67.8",
"v2.68.4",
"v2.69.4",
"v2.70.2",
"v2.70.1",
"v2.71.0",
"v2.70.0",
"v2.63.7",
"v2.64.4",
"v2.65.5",
"v2.66.10",
"v2.67.7",
"v2.69.3",
"v2.68.3",
"v2.69.2",
"v2.68.2",
"v2.67.6",
"v2.66.9",
"v2.69.1",
"v2.69.0",
"v2.68.1",
"v2.67.5",
"v2.66.8",
"v2.67.4",
"v2.66.7",
"v2.68.0",
"v2.66.6",
"v2.67.3",
"v2.66.5",
"v2.67.2",
"v2.67.1",
"v2.66.4",
"v2.67.0",
"v2.66.3",
"v2.66.2",
"v2.66.1",
"v2.66.0",
"v2.65.4",
"v2.65.3",
"v2.65.2",
"v2.65.1",
"v2.64.3",
"v2.65.0",
"v2.63.6",
"v2.64.2",
"v2.64.1",
"v2.63.5",
"v2.64.0",
"v2.63.4",
"v2.63.3",
"v2.63.2",
"v2.63.1",
"v2.63.0",
"v2.62.3",
"v2.62.2",
"v2.62.1",
"v2.62.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31124.json"
}
}
],
"modified": "2026-10-28T02:30:37.589527541Z",
"provider": "osv",
"references": [
"https://github.com/zitadel/zitadel/releases/tag/v2.63.9",
"https://github.com/zitadel/zitadel/releases/tag/v2.64.6",
"https://github.com/zitadel/zitadel/releases/tag/v2.65.7",
"https://github.com/zitadel/zitadel/releases/tag/v2.66.16",
"https://github.com/zitadel/zitadel/releases/tag/v2.67.13",
"https://github.com/zitadel/zitadel/releases/tag/v2.68.9",
"https://github.com/zitadel/zitadel/releases/tag/v2.69.9",
"https://github.com/zitadel/zitadel/releases/tag/v2.70.8",
"https://github.com/zitadel/zitadel/releases/tag/v2.71.6",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31124.json",
"https://github.com/zitadel/zitadel/security/advisories/GHSA-67m4-8g4w-633q",
"https://nvd.nist.gov/vuln/detail/CVE-2025-31124",
"https://github.com/zitadel/zitadel/commit/14de8ecac2afafee4975ed7ac26f3ca4a2b0f82c"
],
"provider_metadata": {
"cwe_ids": [
"CWE-200",
"CWE-203",
"CWE-204"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31124.json"
}
},
"related_cves": [
{
"value": "CVE-2025-31124",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 504720,
"published_at": "2025-03-31T19:38:12.235+00:00"
}