ZITADEL’s LDAP identity provider failed to escape user‑supplied usernames, enabling LDAP filter injection during the login process. An unauthenticated attacker can send specially crafted usernames containing LDAP metacharacters such as '*', '(', or ')' to manipulate the search filter. By observing the differing responses from the authentication endpoint, the attacker can enumerate existing usernames and retrieve sensitive attributes from the LDAP directory, though a full authentication bypass is not possible.

This flaw affects ZITADEL versions from 2.71.11 up to but not including 3.4.10 and 4.15.0. Users running any of these builds in an environment where the LDAP identity provider is enabled are susceptible.

The CVSS score of 7.5 reflects the potential for information disclosure and enumeration of directory contents. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the weakness by sending malformed usernames to the login endpoint; no authentication is required and the attack can be performed from an external network. Successful exploitation can lead to the discovery of all usernames and extraction of LDAP attributes, compromising confidentiality of directory data.