CVE-2024-41952: zitadel — Fix

Description

Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". Due to a implementation change to prevent deadlocks calling the database, the flag would not be correctly respected in all cases and an attacker would gain information if an account exist within ZITADEL, since the error message shows "object not found" instead of the generic error message. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8, and 2.53.9.

Is your site exposed to CVE-2024-41952?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-203 CWE-203

Affected Products

Vendor	Product	Versions
zitadel	zitadel	2.53.0 — 2.53.9
zitadel	zitadel	2.54.0 — 2.54.8
zitadel	zitadel	2.55.0 — 2.55.5
zitadel	zitadel	2.56.0 — 2.56.2
zitadel	zitadel	All
zitadel	zitadel	All
zitadel	zitadel	All
zitadel	zitadel	All

References

Advisories & Patches

https://github.com/zitadel/zitadel/commit/0ab0c645ef914298c343fa39cccb1290aba48bf6 https://github.com/zitadel/zitadel/commit/3c7d12834e32426416235b9e3374be0f4b9380b8 https://github.com/zitadel/zitadel/commit/5c2526c98aafd1ba206be2fa4291b1d24c384f6d https://github.com/zitadel/zitadel/commit/8565d24fd8df5bd35294313cfbfcc2e15aea20e9 https://github.com/zitadel/zitadel/commit/b0e71a81ef39667ce2a149ce037c1ca0edbe059d https://github.com/zitadel/zitadel/commit/fc1d415b8db5b8d481bb65206ce3fc944c0eecea https://github.com/zitadel/zitadel/security/advisories/GHSA-567v-6hmg-6qg7

Other References

https://github.com/zitadel/zitadel/releases/tag/v2.53.9 https://github.com/zitadel/zitadel/releases/tag/v2.54.8 https://github.com/zitadel/zitadel/releases/tag/v2.55.5 https://github.com/zitadel/zitadel/releases/tag/v2.56.2 https://github.com/zitadel/zitadel/releases/tag/v2.57.1 https://github.com/zitadel/zitadel/releases/tag/v2.58.1

Frequently Asked Questions

What is CVE-2024-41952? +

Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". Due to a implementation change to prevent deadlocks calling the database, the flag would not be correctly respected in all cases and an attacker would gain information if an account exist within ZITADEL, since the error message shows "object not found" instead of the generic error message. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8, and 2.53.9. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2024-41952? +

CVE-2024-41952 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-41952? +

CVE-2024-41952 affects products from zitadel, specifically: zitadel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-41952? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-59640

In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy …

CVE-2025-24506

A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.

CVE-2025-29780

Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 …

CVE-2024-11084

Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists.

CVE-2025-6056

Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers …

CVE-2025-13912

Multiple constant-time implementations in wolfSSL before version 5.8.4 may be transformed into non-constant-time binary by LLVM optimizations, which can potentially …

CVE-2024-41952