{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.62.0"
              },
              {
                "fixed": "2.63.9"
              }
            ]
          },
          "events": [
            {
              "introduced": "6210239ed5b8c92bc63d14d050137d2985e99bce"
            },
            {
              "fixed": "90255ef7d8144a922a7357428cd317b95e41d17a"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.64.0-rc.1"
              },
              {
                "fixed": "2.64.6"
              }
            ]
          },
          "events": [
            {
              "introduced": "710a929fad39a83169aa6797487ec7aefb8a4bd8"
            },
            {
              "fixed": "9a614fa98d00cbb0127a6f374da5b00aa5dd12b6"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.65.0-rc.1"
              },
              {
                "fixed": "2.65.7"
              }
            ]
          },
          "events": [
            {
              "introduced": "0aba000355d8f47c213c27b15f9eedc51241a1e3"
            },
            {
              "fixed": "12ad907d3e36a0db735719c552e5135ae9e9f4bd"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.66.0-rc.1"
              },
              {
                "fixed": "2.66.16"
              }
            ]
          },
          "events": [
            {
              "introduced": "e4ebac13aa662bc22574bedf7c33d7c028b783e1"
            },
            {
              "fixed": "2a889a98533cff2e10cf108eb5c649e47d0dca78"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.67.0-rc.1"
              },
              {
                "fixed": "2.67.13"
              }
            ]
          },
          "events": [
            {
              "introduced": "7dc23a749c03eb0c8a4aad30413c2d5b38f89ebc"
            },
            {
              "fixed": "596567deb93499b22d2bb4a9be99cf8a557e4196"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.68.0-rc.1"
              },
              {
                "fixed": "2.68.9"
              }
            ]
          },
          "events": [
            {
              "introduced": "a8e93a77c2ac0ea5733cad7f28c6ce96367724e6"
            },
            {
              "fixed": "bb5db00e948bc8327aed99b2f82383ba46a7ca9c"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.69.0-rc.1"
              },
              {
                "fixed": "2.69.9"
              }
            ]
          },
          "events": [
            {
              "introduced": "8b881f542b621c53e9ca5dd8bd6d62d2f90d4315"
            },
            {
              "fixed": "314cc1495bd734afe78a2df6955df5ce8288de9a"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.70.0-rc.1"
              },
              {
                "fixed": "2.70.8"
              }
            ]
          },
          "events": [
            {
              "introduced": "99c2247ecb36754619617df0c7266162bf37b877"
            },
            {
              "fixed": "318761fd879c81ac1716bacfb2f84d8374efd92c"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.71.0-rc.1"
              },
              {
                "fixed": "2.71.6"
              }
            ]
          },
          "events": [
            {
              "introduced": "732fc6040f69a6703af28151ce2b6cba6e430836"
            },
            {
              "fixed": "4fde7822d8f728007fb0781690a4f8a6d47a1868"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-67m4-8g4w-633q"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-200",
      "CWE-203",
      "CWE-204"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31124.json"
  },
  "details": "Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called \"Ignoring unknown usernames\" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report \"Username or Password invalid\". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.",
  "id": "CVE-2025-31124",
  "modified": "2026-04-01T23:09:32.837859267Z",
  "published": "2025-03-31T19:38:12.235Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.63.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.64.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.65.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.66.16"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.67.13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.68.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.69.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.70.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.71.6"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31124.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-67m4-8g4w-633q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31124"
    },
    {
      "type": "FIX",
      "url": "https://github.com/zitadel/zitadel/commit/14de8ecac2afafee4975ed7ac26f3ca4a2b0f82c"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zitadel  allows User Enumeration by loginname attribute normalization"
}