CVE-2026-23511

—

CVSS 3.1

5.3 medium

EPSS

<1%p32

Published

Jan 15, 2026 (Jan 15, 2026)

Modified

Jun 17, 2026

Description

ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6.

Vendors: zitadel
Products: zitadel
Weakness: CWE-204
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.