CVE-2026-23511: 
NixOS vulnerability analysis and mitigation

CVE-2026-23511 is a user enumeration vulnerability in ZITADEL's login interfaces (Login UI v1 and v2) that allows unauthenticated attackers to confirm the existence of valid user accounts by iterating through usernames and userIDs. The vulnerability was disclosed on January 15, 2026, and affects ZITADEL versions 2.0.0 through 2.71.19, 3.0.0 through 3.4.5, and 4.0.0 through 4.9.0. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory). The vulnerability was reported by Niklas Kunz from Seamly following a penetration test (GitHub Advisory).

The root cause is an Observable Response Discrepancy (CWE-204) in ZITADEL's password reset and code verification endpoints. When arbitrary userIDs are submitted to public login UI endpoints (e.g., the password reset endpoint), the system returns different responses depending on whether the userID exists, enabling account enumeration. Additionally, the Login UI V2 failed to correctly implement the built-in "Ignoring unknown usernames" security feature, which is designed to return a generic response for both valid and invalid usernames — meaning even deployments with this protection enabled remained vulnerable via the V2 interface. The fix, applied in commits 0bb00dd and b85ab69, returns a generic error message (Errors.User.Code.Invalid) regardless of whether the user exists, and suppresses non-internal errors on resend operations to prevent information leakage (GitHub Advisory, Patch Commit).

Successful exploitation allows unauthenticated attackers to enumerate valid user accounts within a ZITADEL instance by analyzing differential responses from the password reset and login UI endpoints. This information can be leveraged to build targeted lists for phishing campaigns, credential stuffing attacks, and other social engineering efforts against confirmed valid users. There is no direct impact on integrity or availability; the confidentiality impact is limited to account existence disclosure. The severity is reduced if rate limiting or CAPTCHA mechanisms are in place (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it straightforward to exploit manually or with simple scripting. The EPSS score is approximately 0.041%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing ZITADEL instances running affected versions (2.0.0–2.71.19, 3.0.0–3.4.5, or 4.0.0–4.9.0) using tools like Shodan or Censys, or by inspecting login page metadata.
2. Identify target endpoints: Locate the password reset or code verification endpoints in the ZITADEL login UI (e.g., the password reset resend endpoint that accepts a userID query parameter).
3. Submit candidate userIDs: Iteratively submit arbitrary userIDs or usernames to the password reset endpoint using a script or tool such as curl, Burp Suite Intruder, or a custom enumeration script.
4. Analyze responses: Compare HTTP responses for each submitted userID — a distinct error message or response code for non-existent users versus a success/generic message for valid users reveals account existence.
5. Enumerate Login UI V2: For instances using Login UI V2, submit candidate usernames to the login page even if "Ignoring unknown usernames" is enabled, as the setting was not correctly enforced, allowing further enumeration.
6. Build target list: Compile confirmed valid usernames/userIDs for use in downstream attacks such as phishing or credential stuffing (GitHub Advisory, Patch Commit).

• Network: High volume of requests to ZITADEL password reset or code verification endpoints from a single IP or small IP range; sequential or patterned userID values in request parameters.
• Logs: ZITADEL access logs showing repeated requests to password reset resend or login UI endpoints with varying userID query parameters in rapid succession; warning log entries such as "error requesting password reset" or "error requesting init mail" appearing at high frequency.
• Behavioral: Unusual spike in password reset request attempts without corresponding email delivery events; requests originating from automated tools (e.g., consistent User-Agent strings, uniform request timing).

Upgrade ZITADEL to a patched version immediately: v3.4.6 or later for 3.x deployments, and v4.9.1 or later for 4.x deployments. For 2.x deployments (≤2.71.19), the advisory recommends upgrading to v3.4.6 or later as the patch path. As interim mitigations, implement rate limiting on password reset and login endpoints to restrict enumeration effectiveness, and consider adding CAPTCHA or challenge-response mechanisms. Note that there is no workaround for the Login UI V2 "Ignoring unknown usernames" bypass — upgrading to a patched version is required if this feature is relied upon (GitHub Advisory, v3.4.6 Release).