Executive brief
ZITADEL, an identity management platform, contains a vulnerability in how it handles logins when connected to an LDAP directory. An unauthenticated attacker can use specially crafted usernames to trick the system into revealing whether specific users exist or to extract sensitive information from the directory. While this does not allow an attacker to log in without a password, it can lead to significant data exposure and user enumeration.
Technical details
An LDAP Filter Injection vulnerability (CWE-90) exists in ZITADEL's LDAP identity provider implementation. The application fails to properly escape user-provided usernames before incorporating them into LDAP search filters during the login process. An unauthenticated attacker can use LDAP metacharacters (e.g., *, (, )) to perform blind LDAP injection. By analyzing the application's responses, an attacker can systematically enumerate valid usernames and extract sensitive attribute data from the connected LDAP directory. While authentication bypass is not possible, the confidentiality impact is high. Patches are available in versions 4.15.0, 3.4.10, and 2.71.20 (implied by the 2.x range fix).
Affected products
- ZITADEL ZITADEL 4.0.0 to 4.14.0, 3.1.0 to 3.4.9, 2.71.11 to 2.71.19
Timeline
- 2026-05-04: disclosed: Initial disclosure by ZITADEL
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-14: kev added: NVD publication date