Security readout for executives and security teams
Plain-English summary
ZITADEL login pages can reveal whether a username or user ID exists. That information can help attackers build valid account lists for later phishing, password guessing, or targeted attacks. The issue is fixed in ZITADEL 4.9.1 and 3.4.6. No source in the bundle reports active exploitation.
Executive priority
Schedule remediation in the normal vulnerability cycle, with faster action for public identity services. This issue does not enable direct takeover by itself, but it can improve attacker targeting against real users.
Technical view
CVE-2026-23511 is a CWE-204 observable response discrepancy in ZITADEL Login UIs. Unauthenticated network attackers can confirm valid usernames or userIDs by comparing login-interface behavior. CVSS is 5.3: network reachable, low complexity, no privileges or user interaction, confidentiality impact only. Affected versions are >=4.0.0 and <4.9.1, and versions <3.4.6.
Likely exposure
Exposure is most relevant for internet-facing or broadly reachable ZITADEL login interfaces running affected versions. Organizations using ZITADEL as a central identity provider should treat this as identity intelligence leakage, not direct account compromise.
Exploitation context
The public description confirms unauthenticated enumeration through login interfaces. The provided sources do not indicate public exploitation, KEV listing, or compromise activity. Risk increases where usernames are reused, predictable, or tied to employee email addresses.
Researcher notes
The advisory identifies the weakness class and fixed versions, but the bundle does not include detailed behavioral conditions for each UI path. Avoid assuming all deployments expose the same surface; validate against deployed version, configuration, and reachable login flows.
Mitigation direction
- Upgrade ZITADEL 4.x deployments to 4.9.1 or later.
- Upgrade ZITADEL 3.x deployments to 3.4.6 or later.
- Check ZITADEL vendor advisory and release notes before production rollout.
- Restrict unnecessary public exposure of login interfaces where operationally feasible.
- Monitor authentication telemetry for unusual repeated account-discovery patterns.
Validation and detection
- Inventory all ZITADEL instances and record running versions.
- Confirm whether affected login interfaces are reachable from untrusted networks.
- Verify upgraded instances report version 4.9.1, 3.4.6, or later.
- Review release notes and advisory applicability for your deployment branch.
- Review authentication logs for abnormal username or userID probing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-204: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-23511 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264rCVE reference · x_refsource_CONFIRM
- https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2CVE reference · x_refsource_MISC
- https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858dCVE reference · x_refsource_MISC
- https://github.com/zitadel/zitadel/releases/tag/v3.4.6CVE reference · x_refsource_MISC
- https://github.com/zitadel/zitadel/releases/tag/v4.9.1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Observable Response Discrepancy
Observable Response Discrepancy represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.