CVE-2026-23511
Medium · 5.3Zitadel has a user enumeration vulnerability in Login UIs
CVSS
5.3
EPSS
0.4%
Published
Jan 15, 2026
CISA due date
—
The record
A user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/zitadel/zitadel | 0 | No fix |
| Go | github.com/zitadel/zitadel | 0 | 3.4.6 |
| Go | github.com/zitadel/zitadel | 4.0.0 | 4.9.1 |
| go | github.com/zitadel/zitadel | 4.0.0 | 4.9.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260123T022811-150000.1.140.1 |
Related vulnerabilities
- GO-2026-4319 Zitadel has a user enumeration vulnerability in Login UIs in github.com/zitadel/zitadel Same vulnerability
- CVE-2026-29067 ZITADEL is an open source identity management platform. Also affects github.com/zitadel/zitadel
- GHSA-282g-fhmx-xf54 ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API Also affects github.com/zitadel/zitadel
- GHSA-6mq3-xmgp-pjm5 ZITADEL's truncated opaque tokens are still valid Also affects github.com/zitadel/zitadel
- CVE-2026-27840 ZITADEL is an open source identity management platform. Also affects github.com/zitadel/zitadel
- CVE-2026-27946 ZITADEL is an open source identity management platform. Also affects github.com/zitadel/zitadel
- GO-2025-4227 Zitadel Discloses the Total Number of Instance Users in github.com/zitadel/zitadel Also affects github.com/zitadel/zitadel
- GO-2025-4210 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in… Also affects github.com/zitadel/zitadel