CVE-2025-31124

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-31124
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31124.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-31124
Aliases
  • GHSA-67m4-8g4w-633q
Published
2025-03-31T19:38:12.235Z
Modified
2026-04-10T05:24:56.147051Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Zitadel allows User Enumeration by loginname attribute normalization
Details

Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.

Database specific 
{
    "cwe_ids": [
        "CWE-200",
        "CWE-203",
        "CWE-204"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31124.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/zitadel/zitadel

Affected ranges

Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
6210239ed5b8c92bc63d14d050137d2985e99bce
Fixed
90255ef7d8144a922a7357428cd317b95e41d17a
Database specific 
{
    "versions": [
        {
            "introduced": "2.62.0"
        },
        {
            "fixed": "2.63.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
710a929fad39a83169aa6797487ec7aefb8a4bd8
Fixed
9a614fa98d00cbb0127a6f374da5b00aa5dd12b6
Database specific 
{
    "versions": [
        {
            "introduced": "2.64.0-rc.1"
        },
        {
            "fixed": "2.64.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
0aba000355d8f47c213c27b15f9eedc51241a1e3
Fixed
12ad907d3e36a0db735719c552e5135ae9e9f4bd
Database specific 
{
    "versions": [
        {
            "introduced": "2.65.0-rc.1"
        },
        {
            "fixed": "2.65.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
e4ebac13aa662bc22574bedf7c33d7c028b783e1
Fixed
2a889a98533cff2e10cf108eb5c649e47d0dca78
Database specific 
{
    "versions": [
        {
            "introduced": "2.66.0-rc.1"
        },
        {
            "fixed": "2.66.16"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
7dc23a749c03eb0c8a4aad30413c2d5b38f89ebc
Fixed
596567deb93499b22d2bb4a9be99cf8a557e4196
Database specific 
{
    "versions": [
        {
            "introduced": "2.67.0-rc.1"
        },
        {
            "fixed": "2.67.13"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
a8e93a77c2ac0ea5733cad7f28c6ce96367724e6
Fixed
bb5db00e948bc8327aed99b2f82383ba46a7ca9c
Database specific 
{
    "versions": [
        {
            "introduced": "2.68.0-rc.1"
        },
        {
            "fixed": "2.68.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
8b881f542b621c53e9ca5dd8bd6d62d2f90d4315
Fixed
314cc1495bd734afe78a2df6955df5ce8288de9a
Database specific 
{
    "versions": [
        {
            "introduced": "2.69.0-rc.1"
        },
        {
            "fixed": "2.69.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
99c2247ecb36754619617df0c7266162bf37b877
Fixed
318761fd879c81ac1716bacfb2f84d8374efd92c
Database specific 
{
    "versions": [
        {
            "introduced": "2.70.0-rc.1"
        },
        {
            "fixed": "2.70.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
732fc6040f69a6703af28151ce2b6cba6e430836
Fixed
4fde7822d8f728007fb0781690a4f8a6d47a1868
Database specific 
{
    "versions": [
        {
            "introduced": "2.71.0-rc.1"
        },
        {
            "fixed": "2.71.6"
        }
    ]
}

Affected versions

v2.*
v2.62.0
v2.62.1
v2.62.2
v2.62.3
v2.63.0
v2.63.1
v2.63.2
v2.63.3
v2.63.4
v2.63.5
v2.63.6
v2.63.7
v2.63.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31124.json"