5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23511

CVE-2026-23511: ZITADEL has a user enumeration vulnerability in Login UIs

ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23511

CVE-2026-23511:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/zitadel/zitadel	go	>= 4.0.0, <= 4.9.0	4.9.1
github.com/zitadel/zitadel	go	<= 3.4.5	3.4.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in several functions within the login UI that handle user-related actions like password resets, user initialization, and email verification. These functions would respond differently depending on whether a provided user ID existed or not. An attacker could exploit this by sending requests with different user IDs and observing the system's responses to enumerate valid user accounts. The patch addresses this by ensuring that the error messages and responses are generic and do not reveal whether a user account exists. Specifically, in cases where an invalid user ID is provided, the system now returns a generic error message, similar to when a wrong verification code is provided for a valid user. This makes it impossible for an attacker to distinguish between a non-existent user and a user with an invalid code, thus mitigating the user enumeration vulnerability.

Vulnerable functions

Login.checkPWCode

internal/api/ui/login/init_password_handler.go

The function `checkPWCode` was vulnerable because it would pass a specific error to `renderInitPassword` when a user was not found. This difference in error handling compared to a valid user allowed an attacker to enumerate user IDs. The patch replaces the specific error with a generic one.

Login.resendPasswordSet

internal/api/ui/login/init_password_handler.go

The function `resendPasswordSet` was vulnerable because it would pass a specific error to `renderInitPassword` when a user was not found. This difference in error handling compared to a valid user allowed an attacker to enumerate user IDs. The patch ignores the error to prevent information leakage.

Login.checkUserInitCode

internal/api/ui/login/init_user_handler.go

The function `checkUserInitCode` was vulnerable because it would pass a specific error to `renderInitUser` when a user was not found. This difference in error handling compared to a valid user allowed an attacker to enumerate user IDs. The patch replaces the specific error with a generic one.

Login.resendUserInit

internal/api/ui/login/init_user_handler.go

The function `resendUserInit` was vulnerable because it would pass a specific error to `renderInitUser` when a user was not found. This difference in error handling compared to a valid user allowed an attacker to enumerate user IDs. The patch ignores the error to prevent information leakage.

Login.checkUserInviteCode

internal/api/ui/login/invite_user_handler.go

The function `checkUserInviteCode` was vulnerable because it would pass a specific error to `renderInviteUser` when a user was not found. This difference in error handling compared to a valid user allowed an attacker to enumerate user IDs. The patch replaces the specific error with a generic one.

Login.resendUserInvite

internal/api/ui/login/invite_user_handler.go

The function `resendUserInvite` was vulnerable because it would pass a specific error to `renderInviteUser` when a user was not found. This difference in error handling compared to a valid user allowed an attacker to enumerate user IDs. The patch ignores the error to prevent information leakage.

Login.handleMailVerificationCheck

internal/api/ui/login/mail_verify_handler.go

The function `handleMailVerificationCheck` was vulnerable because it would pass a specific error to `renderMailVerification` when a user was not found. This difference in error handling compared to a valid user allowed an attacker to enumerate user IDs. The patch ignores the error to prevent information leakage.

Login.checkMailCode

internal/api/ui/login/mail_verify_handler.go

The function `checkMailCode` was vulnerable because it would pass a specific error to `renderMailVerification` when a user was not found. This difference in error handling compared to a valid user allowed an attacker to enumerate user IDs. The patch replaces the specific error with a generic one.

Login.getPasswordComplexityPolicyByUserID

internal/api/ui/login/password_complexity_policy_handler.go

The function `getPasswordComplexityPolicyByUserID` was vulnerable to a side-channel attack. If a user ID did not exist, the function would return early. The patch changes the logic to proceed with fetching a default policy, making the execution path more consistent regardless of whether the user exists, thus preventing user enumeration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.