Log in Start free

Vulnerability · Published Oct 25, 2024 · Assigned by GitHub_M

CVE-2024-49757Zitadel User Registration Bypass Vulnerability

High 7.5

In plain English

A high-severity improper authentication in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.5%top 15.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei

Official description

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/zitadel/zitadel2.63.5GHSA-3rmw-76m6-4gjc
Gogithub.com/zitadel/zitadel2.62.7GHSA-3rmw-76m6-4gjc
Gogithub.com/zitadel/zitadel2.61.4GHSA-3rmw-76m6-4gjc
Gogithub.com/zitadel/zitadel2.60.4GHSA-3rmw-76m6-4gjc
Gogithub.com/zitadel/zitadel2.59.5GHSA-3rmw-76m6-4gjc
Gogithub.com/zitadel/zitadel2.58.7GHSA-3rmw-76m6-4gjc
Gogithub.com/zitadel/zitadelno fix listedGO-2024-3217

Affected products (as reported)

VendorProductVersions
zitadel zitadel >= 2.63, < 2.63.5>= 2.62, < 2.62.7>= 2.61, < 2.61.3>= 2.60, < 2.60.3>= 2.59, < 2.59.4< 2.58.6

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References