UpHeron
All vulnerabilities

Servers and applications

CVE-2024-41952

Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". Due to a implementation change to prevent deadlocks calling the…

Severity
Medium 5.3
Published
31 Jul 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.53.9, 2.54.8, 2.55.5, 2.56.2
Sources
NVD

Affected software

SoftwareAffected versions
ZITADELServers and applications · cpe:a:zitadel:zitadel
  • Version 2.58.0
  • Version 2.57.0
  • Version 2.57.0-rc2
  • Version 2.57.0-rc1
All 8 release lines
  • From 2.53.0 before 2.53.9
  • From 2.54.0 before 2.54.8
  • From 2.55.0 before 2.55.5
  • From 2.56.0 before 2.56.2
  • Version 2.57.0-rc1
  • Version 2.57.0-rc2
  • Version 2.57.0
  • Version 2.58.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-41952
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-41952