-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | < 2.37.3 | 2.37.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing enforcement of the 'Ignore unknown usernames' setting in the password reset flow. While authentication flows properly hid account existence, the password reset handler likely contained a code path that: 1. Checked for username existence first 2. Returned different error messages for existing/non-existing accounts 3. Failed to apply the organization-level security setting that should mask this information. The patch commit 8ca053f specifically mentions fixing this by respecting the setting in password reset, indicating the handler function was modified to include the missing check.
Ongoing coverage of React2Shell