CVE-2026-44671

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44671
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44671.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44671
Aliases
Published
2026-05-14T21:13:03.077Z
Modified
2026-07-08T08:12:34.891193950Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
ZITADEL: LDAP Filter Injection in Login Flow
Details

ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process. While this vulnerability does not allow for a full authentication bypass, an attacker can use LDAP metacharacters (such as *, (, )) to perform blind LDAP injection. By observing the different failure (or success) responses, an attacker can systematically enumerate valid usernames and extract sensitive attribute data from the connected LDAP directory. This vulnerability is fixed in 3.4.10 and 4.15.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44671.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-90"
    ]
}
References

Affected packages

Git / github.com/zitadel/zitadel

Affected ranges

Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
373f9fd4185cde71a0852f5d376d52005b79cb27
Fixed
59fa3018d68eb16c3b2ffe0c9d03dabfc3ab5749
Introduced
c86c60bab86b64b44755d2776703939c01686055
Fixed
a56d4bf0bc9212a25f11ad073c0172d3124e5414
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.71.11"
        },
        {
            "fixed": "3.4.10"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.15.0"
        }
    ]
}

Affected versions

v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.1.4
v4.10.0
v4.10.1
v4.11.0
v4.11.1
v4.12.0
v4.12.1
v4.12.2
v4.12.3
v4.13.0
v4.13.1
v4.14.0
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.4.0
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.6.4
v4.6.5
v4.6.6
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.7.4
v4.7.5
v4.7.6
v4.8.0
v4.8.1
v4.9.0
v4.9.1
v4.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44671.json"