ZITADEL’s login interfaces allow an unauthenticated attacker to determine whether a username or userID exists by observing differences in the system’s responses. The flaw is a classic user‑enumeration weakness (CWE‑204) that can lead to targeted credential‑guessing attacks or social‑engineering attempts. The public CVSS score of 5.3 indicates a moderate severity, reflecting the lack of direct privilege escalation but the potential for privacy and attack‑surface amplification.

All installations of ZITADEL running a version prior to 4.9.1 or 3.4.6 are affected. The vulnerability exists in the login user interfaces of those releases according to the vendor’s release notes and commit history.

Because the flaw requires no authentication and can be triggered via the standard web login UI, it is highly accessible to any external party with internet access to the service. Exploitation is straightforward: a malicious actor cycles through likely usernames and conditions on the response timing or content to infer account existence. The EPSS score of less than 1% and its absence from the CISA KEV catalog suggest current exploitation rates are low, but the ease of the attack vector means the risk remains tangible for environments with exposed login portals.