CVE-2024-49757 Zitadel User Registration Bypass Vulnerability
Attackers can bypass disabled user registration restrictions by directly accessing the registration URL, allowing unauthorized account creation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49757?
CVE-2024-49757 is a high-severity authentication bypass vulnerability in zitadel, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.
Weakness: CWE-287
Which versions are affected by CVE-2024-49757?
13 open source packages ship an affected version, including github.com/zitadel/zitadel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zitadel/zitadel Go | All versions | None |
github.com/zitadel/zitadel Go | All versions | 2.58.7 |
github.com/zitadel/zitadel Go | All versions | 2.58.7 |
github.com/zitadel/zitadel Go | From 2.59.0 | 2.59.5 |
github.com/zitadel/zitadel Go | From 2.59.0 | 2.59.5 |
github.com/zitadel/zitadel Go | From 2.60.0 | 2.60.4 |
7 more packages
github.com/zitadel/zitadel Go | From 2.60.0 | 2.60.4 |
github.com/zitadel/zitadel Go | From 2.61.0 | 2.61.4 |
github.com/zitadel/zitadel Go | From 2.61.0 | 2.61.4 |
github.com/zitadel/zitadel Go | From 2.62.0 | 2.62.7 |
github.com/zitadel/zitadel Go | From 2.62.0 | 2.62.7 |
github.com/zitadel/zitadel Go | From 2.63.0 | 2.63.5 |
github.com/zitadel/zitadel Go | From 2.63.0 | 2.63.5 |
Products include Zitadel Zitadel.
How do I fix CVE-2024-49757?
Upgrade github.com/zitadel/zitadel to a fixed version for your release line: 2.58.7, 2.59.5, 2.60.4 or 2.61.4.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-49757 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-49757 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in zitadel
- CVE-2026-29191 ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
- CVE-2025-67494 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
- CVE-2025-27507 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
- CVE-2025-64103 Zitadel Bypass Second Authentication Factor
- CVE-2025-31123 Zitadel Expired JWT Keys Usable for Authorization Grants
Sources
Also known as GHSA-3rmw-76m6-4gjc, GO-2024-3217.