CVE-2025-57770 ZITADEL user enumeration vulnerability in login UI

Medium 5.3 Published 22 Aug 2025 Updated 22 Aug 2025

An unauthenticated attacker can enumerate valid user accounts by bypassing the login UI's unknown username protection, exposing user existence.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-57770?

CVE-2025-57770 is a medium-severity vulnerability in zitadel, published on 22 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.2, 3.0.0 to 3.3.6, and all versions prior to 2.71.15 are vulnerable to a username enumeration issue in the login interface. The login UI includes a security feature, Ignoring unknown usernames, that is intended to prevent username enumeration by returning a generic response for both valid and invalid usernames. This vulnerability allows an unauthenticated attacker to bypass this protection by submitting arbitrary userIDs to the select account page and distinguishing between valid and invalid accounts based on the system's response. For effective exploitation, an attacker needs to iterate through possible userIDs, but the impact can be limited by implementing rate limiting or similar measures. The issue has been patched in versions 4.0.3, 3.4.0, and 2.71.15.

Weakness: CWE-203

Which versions are affected by CVE-2025-57770?

It affects 1 product.

Products include Zitadel Zitadel.

How do I fix CVE-2025-57770?

No fix has been published for CVE-2025-57770 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-57770 being exploited?

There is no known exploitation of CVE-2025-57770 in the wild and no public exploit code.

Sources

Also known as GHSA-g9c3-xh6v-fr86.