CVE-2023-44399 - CVE House
Back to Database
Status published Medium CVE-2023-44399

ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting

Vulnerability Description

ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL. This bug has been patched in versions 2.37.3 and 2.38.0. No known workarounds are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-44399

Credits & Attribution

No credits recorded in the NVD database.

References

More from zitadel

View All →
CVE-2025-67717
Zitadel Discloses the Total Number of Instance Users
Medium 5.3
CVE-2025-67495
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
High 8
CVE-2025-67494
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
Critical 9.3
CVE-2025-64717
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
High 7.4
CVE-2025-64431
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
High 8.7

Affected Vendor

Affected Software

zitadel
Vulnerable Versions:
< 2.37.3

Timeline

Official Publish: October 10th, 2023
Last Modified: September 19th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-640

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.