Listen to this Post
How the mentioned CVE works (around 20 lines):
This user enumeration vulnerability exists in Zitadel’s login UI (both V1 and V2) for password reset functionality. An unauthenticated attacker can send HTTP POST requests containing arbitrary `userID` parameters to the password reset endpoint. The system’s response differs based on whether the submitted `userID` corresponds to a valid, existing user account. For valid accounts, the system initiates a reset email process, while for invalid IDs, it returns an error. This discrepancy in behavior allows an attacker to iterate through potential userIDs and map out which accounts exist in the system. Additionally, the security feature “Ignoring unknown usernames,” designed to return generic responses, was malfunctioning in Login UI V2. This failure further enabled attackers to enumerate valid usernames directly on the login page by observing response variations.
Platform: Zitadel
Version: v2.x – v4.x
Vulnerability : User Enumeration
Severity: Medium
date: 2026-01-16
Prediction: Patched >=4.9.1
What Undercode Say:
Bash commands and codes related to the blog
curl -X POST https://target.zitadel.com/ui/login/password/reset?userID=attacker-guess-1 curl -X POST https://target.zitadel.com/ui/login/password/reset?userID=attacker-guess-2 Analyze HTTP response codes or body content differences.
How Exploit:
Attackers send automated, sequential requests to the password reset endpoint (/ui/login/password/reset) with different `userID` or username values. They parse the HTTP response status codes, response times, or error message content to identify which parameters result in the behavior associated with a valid user (e.g., a 202 Accepted vs. a 400 Bad Request).
Protection from this CVE
Immediately upgrade Zitadel to the patched versions: v4.9.1+, v3.4.6+, or apply the patch for v2.x. As a secondary measure, implement strict rate limiting and request throttling on all login and password reset endpoints to significantly slow down automated enumeration attempts.
Impact
Successful exploitation allows an unauthenticated attacker to confirm the existence of valid user accounts. This enumerated list can be used for targeted phishing campaigns, credential stuffing attacks, or as the first step in a more complex attack chain, undermining user privacy and system security.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
