CVE-2025-57770 (GCVE-0-2025-57770)
Vulnerability from cvelistv5
Published
2025-08-22 16:50
Modified
2025-08-22 20:05
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
Summary
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.2, 3.0.0 to 3.3.6, and all versions prior to 2.71.15 are vulnerable to a username enumeration issue in the login interface. The login UI includes a security feature, Ignoring unknown usernames, that is intended to prevent username enumeration by returning a generic response for both valid and invalid usernames. This vulnerability allows an unauthenticated attacker to bypass this protection by submitting arbitrary userIDs to the select account page and distinguishing between valid and invalid accounts based on the system's response. For effective exploitation, an attacker needs to iterate through possible userIDs, but the impact can be limited by implementing rate limiting or similar measures. The issue has been patched in versions 4.0.3, 3.4.0, and 2.71.15.
References
security-advisories@github.comhttps://github.com/zitadel/zitadel/commit/7abe759c95cb360524d88b51744d03cbb6e4dcdbPatch
security-advisories@github.comhttps://github.com/zitadel/zitadel/releases/tag/v2.71.15Release Notes
security-advisories@github.comhttps://github.com/zitadel/zitadel/releases/tag/v3.4.0Release Notes
security-advisories@github.comhttps://github.com/zitadel/zitadel/releases/tag/v4.0.3Release Notes
security-advisories@github.comhttps://github.com/zitadel/zitadel/security/advisories/GHSA-g9c3-xh6v-fr86Vendor Advisory
security-advisories@github.comhttps://zitadel.com/docs/self-hosting/manage/production#limits-and-quotasProduct
Impacted products
Vendor Product Version
zitadel zitadel Version: < 2.71.15
Version: >= 3.0.0, < 3.4.0
Version: >= 4.0.0, < 4.0.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-57770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-22T20:04:52.320114Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-22T20:05:08.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zitadel",
          "vendor": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.71.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.4.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.2, 3.0.0 to 3.3.6, and all versions prior to 2.71.15 are vulnerable to a username enumeration issue in the login interface. The login UI includes a security feature, Ignoring unknown usernames, that is intended to prevent username enumeration by returning a generic response for both valid and invalid usernames. This vulnerability allows an unauthenticated attacker to bypass this protection by submitting arbitrary userIDs to the select account page and distinguishing between valid and invalid accounts based on the system\u0027s response. For effective exploitation, an attacker needs to iterate through possible userIDs, but the impact can be limited by implementing rate limiting or similar measures. The issue has been patched in versions 4.0.3, 3.4.0, and 2.71.15."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-203",
              "description": "CWE-203: Observable Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-22T16:50:35.002Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-g9c3-xh6v-fr86",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-g9c3-xh6v-fr86"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/7abe759c95cb360524d88b51744d03cbb6e4dcdb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/7abe759c95cb360524d88b51744d03cbb6e4dcdb"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v2.71.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v2.71.15"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.0"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v4.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v4.0.3"
        },
        {
          "name": "https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas"
        }
      ],
      "source": {
        "advisory": "GHSA-g9c3-xh6v-fr86",
        "discovery": "UNKNOWN"
      },
      "title": "ZITADEL user enumeration vulnerability in login UI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-57770",
    "datePublished": "2025-08-22T16:50:35.002Z",
    "dateReserved": "2025-08-19T15:16:22.917Z",
    "dateUpdated": "2025-08-22T20:05:08.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-57770\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-08-22T17:15:35.997\",\"lastModified\":\"2025-08-27T19:12:57.573\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.2, 3.0.0 to 3.3.6, and all versions prior to 2.71.15 are vulnerable to a username enumeration issue in the login interface. The login UI includes a security feature, Ignoring unknown usernames, that is intended to prevent username enumeration by returning a generic response for both valid and invalid usernames. This vulnerability allows an unauthenticated attacker to bypass this protection by submitting arbitrary userIDs to the select account page and distinguishing between valid and invalid accounts based on the system\u0027s response. For effective exploitation, an attacker needs to iterate through possible userIDs, but the impact can be limited by implementing rate limiting or similar measures. The issue has been patched in versions 4.0.3, 3.4.0, and 2.71.15.\"},{\"lang\":\"es\",\"value\":\"El software de infraestructura de identidad de c\u00f3digo abierto Zitadel permite a los administradores desactivar el autorregistro de usuarios. Las versiones 4.0.0 a 4.0.2, 3.0.0 a 3.3.6 y todas las versiones anteriores a la 2.71.15 son vulnerables a un problema de enumeraci\u00f3n de nombres de usuario en la interfaz de inicio de sesi\u00f3n. Esta interfaz incluye una funci\u00f3n de seguridad, Ignorar nombres de usuario desconocidos, que impide la enumeraci\u00f3n de nombres de usuario devolviendo una respuesta gen\u00e9rica tanto para nombres de usuario v\u00e1lidos como no v\u00e1lidos. Esta vulnerabilidad permite a un atacante no autenticado eludir esta protecci\u00f3n enviando ID de usuario arbitrarios a la p\u00e1gina de selecci\u00f3n de cuenta y distinguiendo entre cuentas v\u00e1lidas e inv\u00e1lidas seg\u00fan la respuesta del sistema. Para una explotaci\u00f3n eficaz, un atacante debe iterar entre los posibles ID de usuario, pero el impacto puede limitarse implementando una limitaci\u00f3n de velocidad o medidas similares. El problema se ha corregido en las versiones 4.0.3, 3.4.0 y 2.71.15.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-203\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.71.15\",\"matchCriteriaId\":\"E5A53891-3BA9-4CEB-82AC-B9F39CD1A02E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.4.0\",\"matchCriteriaId\":\"3D35DEF8-57A6-4ECF-9737-7604002DEE70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.0.3\",\"matchCriteriaId\":\"B15FCB28-4B32-45DA-9566-2F774895CF1F\"}]}]}],\"references\":[{\"url\":\"https://github.com/zitadel/zitadel/commit/7abe759c95cb360524d88b51744d03cbb6e4dcdb\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/zitadel/zitadel/releases/tag/v2.71.15\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/zitadel/zitadel/releases/tag/v3.4.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/zitadel/zitadel/releases/tag/v4.0.3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/zitadel/zitadel/security/advisories/GHSA-g9c3-xh6v-fr86\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-57770\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-22T20:04:52.320114Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-22T20:05:00.724Z\"}}], \"cna\": {\"title\": \"ZITADEL user enumeration vulnerability in login UI\", \"source\": {\"advisory\": \"GHSA-g9c3-xh6v-fr86\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"zitadel\", \"product\": \"zitadel\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.71.15\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.0.0, \u003c 3.4.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 4.0.3\"}]}], \"references\": [{\"url\": \"https://github.com/zitadel/zitadel/security/advisories/GHSA-g9c3-xh6v-fr86\", \"name\": \"https://github.com/zitadel/zitadel/security/advisories/GHSA-g9c3-xh6v-fr86\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/zitadel/zitadel/commit/7abe759c95cb360524d88b51744d03cbb6e4dcdb\", \"name\": \"https://github.com/zitadel/zitadel/commit/7abe759c95cb360524d88b51744d03cbb6e4dcdb\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/releases/tag/v2.71.15\", \"name\": \"https://github.com/zitadel/zitadel/releases/tag/v2.71.15\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/releases/tag/v3.4.0\", \"name\": \"https://github.com/zitadel/zitadel/releases/tag/v3.4.0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/releases/tag/v4.0.3\", \"name\": \"https://github.com/zitadel/zitadel/releases/tag/v4.0.3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas\", \"name\": \"https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.2, 3.0.0 to 3.3.6, and all versions prior to 2.71.15 are vulnerable to a username enumeration issue in the login interface. The login UI includes a security feature, Ignoring unknown usernames, that is intended to prevent username enumeration by returning a generic response for both valid and invalid usernames. This vulnerability allows an unauthenticated attacker to bypass this protection by submitting arbitrary userIDs to the select account page and distinguishing between valid and invalid accounts based on the system\u0027s response. For effective exploitation, an attacker needs to iterate through possible userIDs, but the impact can be limited by implementing rate limiting or similar measures. The issue has been patched in versions 4.0.3, 3.4.0, and 2.71.15.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-203\", \"description\": \"CWE-203: Observable Discrepancy\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-08-22T16:50:35.002Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-57770\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-22T20:05:08.582Z\", \"dateReserved\": \"2025-08-19T15:16:22.917Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-08-22T16:50:35.002Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.