CVE-2023-44399
Description
ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL. This bug has been patched in versions 2.37.3 and 2.38.0. No known workarounds are available.
How to fix
- github.com/zitadel/zitadel2.37.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zitadel zitadel | v ≤ 2.37.2 | — |
| github.com/zitadel/zitadelGo | v < 2.37.3 | 2.37.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.