CVE-2025-31124
Estado: AnalizadaMedia (5.3)—
Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Puntuación base: 5.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.52%
- Percentil entre todas las CVEs puntuadas: 42
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-200, CWE-203, CWE-204
Referencias
- https://github.com/zitadel/zitadel/commit/14de8ecac2afafee4975ed7ac26f3ca4a2b0f82c
- https://github.com/zitadel/zitadel/releases/tag/v2.63.9
- https://github.com/zitadel/zitadel/releases/tag/v2.64.6
- https://github.com/zitadel/zitadel/releases/tag/v2.65.7
- https://github.com/zitadel/zitadel/releases/tag/v2.66.16
- https://github.com/zitadel/zitadel/releases/tag/v2.67.13
- https://github.com/zitadel/zitadel/releases/tag/v2.68.9
- https://github.com/zitadel/zitadel/releases/tag/v2.69.9
- https://github.com/zitadel/zitadel/releases/tag/v2.70.8
- https://github.com/zitadel/zitadel/releases/tag/v2.71.6
- https://github.com/zitadel/zitadel/security/advisories/GHSA-67m4-8g4w-633q
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-31124",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-31124",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-03-31T22:26:27.377115Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "zitadel",
"product": "zitadel",
"versions": [
{
"status": "affected",
"version": ">= 2.62.0, < 2.63.9"
},
{
"status": "affected",
"version": ">= 2.64.0-rc.1, < 2.64.6"
},
{
"status": "affected",
"version": ">= 2.65.0-rc.1, < 2.65.7"
},
{
"status": "affected",
"version": ">= 2.66.0-rc.1, < 2.66.16"
},
{
"status": "affected",
"version": ">= 2.67.0-rc.1, < 2.67.13"
},
{
"status": "affected",
"version": ">= 2.68.0-rc.1, < 2.68.9"
},
{
"status": "affected",
"version": ">= 2.69.0-rc.1, < 2.69.9"
},
{
"status": "affected",
"version": ">= 2.70.0-rc.1, < 2.70.8"
},
{
"status": "affected",
"version": ">= 2.71.0-rc.1, < 2.71.6"
}
]
}
]
}
],
"published": "2025-03-31T20:15:15.707",
"references": [
{
"url": "https://github.com/zitadel/zitadel/commit/14de8ecac2afafee4975ed7ac26f3ca4a2b0f82c",
"tags": [
"Patch"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.63.9",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.64.6",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.65.7",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.66.16",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.67.13",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.68.9",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.69.9",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.70.8",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.71.6",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-67m4-8g4w-633q",
"tags": [
"Vendor Advisory"
],
"source": "security-advisories@github.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "CWE-203"
},
{
"lang": "en",
"value": "CWE-204"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called \"Ignoring unknown usernames\" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report \"Username or Password invalid\". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9."
},
{
"lang": "es",
"value": "Zitadel es un software de infraestructura de identidad de código abierto. Los administradores de ZITADEL pueden habilitar la configuración \"Ignorar nombres de usuario desconocidos\", que ayuda a mitigar los ataques que intentan adivinar o enumerar nombres de usuario. Si se habilita, ZITADEL mostrará la solicitud de contraseña incluso si el usuario no existe e informará \"Nombre de usuario o contraseña no válidos\". Si bien la configuración se respetó correctamente durante el inicio de sesión, el nombre de usuario se normalizó, lo que reveló su existencia. Esta vulnerabilidad está corregida en las versiones 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6 y 2.63.9."
}
],
"lastModified": "2026-06-17T09:09:53.930",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1B2AF1D0-3069-4836-9BF4-229A6CC269EA",
"versionEndExcluding": "2.63.9"
},
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7142F7F-9380-4C7B-A48F-D4A86F5F9759",
"versionEndExcluding": "2.64.6",
"versionStartIncluding": "2.64.0"
},
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE6B033C-D29A-4AFE-B836-F1763E7844F2",
"versionEndExcluding": "2.65.7",
"versionStartIncluding": "2.65.0"
},
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5DD1E62B-7DDC-474E-A100-5B0569F5B8FE",
"versionEndExcluding": "2.66.16",
"versionStartIncluding": "2.66.0"
},
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0D9F074-8DBB-4FFC-A104-B33B902FDD02",
"versionEndExcluding": "2.67.13",
"versionStartIncluding": "2.67.0"
},
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8DE6D67C-182B-4F08-B4A8-D24A0FD2B66B",
"versionEndExcluding": "2.68.9",
"versionStartIncluding": "2.68.0"
},
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2723F26-27EE-4EA2-845D-93DFA3D2B3F0",
"versionEndExcluding": "2.69.9",
"versionStartIncluding": "2.69.0"
},
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC6090EB-53CF-43AC-AB5B-D51AA2A539C1",
"versionEndExcluding": "2.70.8",
"versionStartIncluding": "2.70.0"
},
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3FD8F27A-ED3D-4674-8D57-F348A320A17B",
"versionEndExcluding": "2.71.6",
"versionStartIncluding": "2.71.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}