ZKTeco ZKBioSecurity 3.0 contains a vulnerability that allows an unauthenticated attacker to enumerate valid usernames by submitting partial username strings to the authLoginAction!login.do endpoint. The application returns distinguishable responses based on whether the supplied prefix matches an existing account, enabling enumeration of user identities. This user enumeration weakness can be leveraged to facilitate subsequent credential guessing or phishing attacks, compromising confidentiality and enabling targeted attacks. This vulnerability is an example of CWE‑551.

Both ZKTeco Inc. and its ZKBioSecurity access control system are affected. The vulnerability exists in version 3.0 of ZKBioSecurity. No other versions were listed, so only this specific release is known to be impacted.

With a CVSS score of 9.3 the flaw is considered critical, yet the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not cataloged in the CISA KEV list. An attacker can exploit it remotely by sending HTTP requests over the network to the affected device, provided the authLoginAction!login.do endpoint is reachable. Due to the lack of authentication, any network participant could begin enumeration, which can be automated via scripts.