Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/zitadel/zitadel
  4. ›
  5. CVE-2023-44399

CVE-2023-44399: Weak Password Recovery Mechanism for Forgotten Password

October 10, 2023

ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called “Ignoring unknown usernames” which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it does not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL. This bug has been patched in versions 2.37.3 and 2.38.0. No known workarounds are available.

References

  • github.com/advisories/GHSA-v683-rcxx-vpff
  • github.com/zitadel/zitadel/releases/tag/v2.37.3
  • github.com/zitadel/zitadel/releases/tag/v2.38.0
  • github.com/zitadel/zitadel/security/advisories/GHSA-v683-rcxx-vpff
  • nvd.nist.gov/vuln/detail/CVE-2023-44399

Code Behaviors & Features

Detect and mitigate CVE-2023-44399 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 2.37.3

Fixed versions

  • 2.37.3

Solution

Upgrade to version 2.37.3 or above.

Impact 5.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-640: Weak Password Recovery Mechanism for Forgotten Password

Source file

go/github.com/zitadel/zitadel/CVE-2023-44399.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:02 +0000.