https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:50:57 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00674 bdu:2026-00674 https://cve.radiocsirt.org/vuln/bdu:2026-00674 https://cve.radiocsirt.org/vuln/euvd-2026-265858 EUVD-2026-265858 https://cve.radiocsirt.org/vuln/euvd-2026-265858 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23511 <p>ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel&#39;s login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6.</p> <p>ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel&#39;s login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23511 https://cve.radiocsirt.org/vuln/ghsa-pvm5-9frx-264r <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A user enumeration vulnerability has been discovered in Zitadel&#39;s login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs.</p> <p>### Impact</p> <p>The login UIs (in version 1 and 2) provide the possibility to request a password reset, where an email will be sent to the user with a link to a verification endpoint. By submitting arbitrary userIDs to these endpoints, an attacker can differentiate between valid and invalid accounts based on the system&#39;s response.</p> <p>For an effective exploit the attacker needs to iterate through the potential set of userIDs. The impact can be limited by implementing [rate limiting](https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas) or similar measures to limit enumeration of userIDs.</p> <p>Additionally, Zitadel includes a security feature &#34;Ignoring unknown usernames&#34;, designed to prevent username enumeration attacks by presenting a generic response for both valid and invalid usernames on the login page. The login UI V2 did not handle the setting correctly and would allow attackers to enumerate through usernames to check their existence.</p> <p>### Affected Versions</p> <p>All versions within the following ranges, including release candidates (RCs), are affected: - **v4.x**: `4.0.0` through `4.9.0` - **3.x**: `3.0.0` through `3.4.5` - **2.x**: `2.0.0` through `2.71.19`</p> <p>### Patches</p> <p>The vulnerability has been addressed in the latest releas…</p> <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A user enumeration vulnerability has been discovered in Zitadel&#39;s login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs.</p> <p>### Impact</p> <p>The login UIs (in version 1 and 2) provide the possibility to request a password reset, where an email will be sent to the user with a link to a verification endpoint. By submitting arbitrary userIDs to these endpoints, an attacker can differentiate between valid and invalid accounts based on the system&#39;s response.</p> <p>For an effective exploit the attacker needs to iterate through the potential set of userIDs. The impact can be limited by implementing [rate limiting](https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas) or similar measures to limit enumeration of userIDs.</p> <p>Additionally, Zitadel includes a security feature &#34;Ignoring unknown usernames&#34;, designed to prevent username enumeration attacks by presenting a generic response for both valid and invalid usernames on the login page. The login UI V2 did not handle the setting correctly and would allow attackers to enumerate through usernames to check their existence.</p> <p>### Affected Versions</p> <p>All versions within the following ranges, including release candidates (RCs), are affected: - **v4.x**: `4.0.0` through `4.9.0` - **3.x**: `3.0.0` through `3.4.5` - **2.x**: `2.0.0` through `2.71.19`</p> <p>### Patches</p> <p>The vulnerability has been addressed in the latest releas…</p> https://cve.radiocsirt.org/vuln/ghsa-pvm5-9frx-264r