What is the CVSS score of CVE-2026-44671?

CVE-2026-44671 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Zitadel are affected by CVE-2026-44671?

Zitadel identity provider instances configured with LDAP are vulnerable to unauthenticated username enumeration and sensitive directory attribute extraction through LDAP filter injection attacks,…. A patch is available.

How to fix or mitigate CVE-2026-44671?

Within 24 hours: Inventory all Zitadel deployments and identify instances running versions 2.71.11-2.71.19, 3.1.0-3.4.9, or 4.0.0-4.14.0 with LDAP configured; disable LDAP identity provider if not immediately business-critical. Within 7 days: Upgrade Zitadel to patched versions (3.4.10 or later for 3.x branch; 4.15.0 or later for 4.x branch); version 2.71.x has no patch available-migrate to supported branch. Within 30 days: Implement LDAP query result filtering and rate limiting; review LDAP access logs for anomalous enumeration patterns; consider network segmentation to restrict LDAP identity provider access.

Zitadel CVE-2026-44671

EUVD-2026-30492 HIGH

LDAP Injection (CWE-90)

2026-05-08 https://github.com/zitadel/zitadel

GHSA-rxvx-hhpj-q6px

Authentication Bypass LDAP Information Disclosure Code Injection

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 08, 2026 - 17:46 vuln.today

Analysis Generated

May 08, 2026 - 17:46 vuln.today

CVE Published

May 08, 2026 - 17:11 nvd

HIGH 7.5

DescriptionGitHub Advisory

Summary

A vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process.

Impact

While this vulnerability does not allow for a full authentication bypass, an attacker can use LDAP metacharacters (such as *, (, )) to perform blind LDAP injection. By observing the different failure (or success) responses, an attacker can systematically enumerate valid usernames and extract sensitive attribute data from the connected LDAP directory.

Note that an authentication bypass is not possible.

Affected Versions

Systems integrating LDAP as IdPs and running one of the following versions are affected:

4.x: 4.0.0 through 4.14.0 (including RC versions)
3.x: 3.1.0 through 3.4.9
2.x: 2.71.11 through 2.71.19

Patches

The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.

4.x: Upgrade to >=4.15.0
3.x: Update to >=3.4.10
2.x: Update to >=3.4.10

Workarounds

The recommended solution is to upgrade to a patched version. If an immediate upgrade is not possible, developers should ensure their project's LDAP directory has strict access controls to limit the scope of information disclosure.

Questions

If there are any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com)

Credits

This vulnerability was identified and reported by ProScan AppSec (https://proscan.one/).

AnalysisAI

LDAP Filter Injection in Zitadel's identity provider implementation allows unauthenticated remote attackers to enumerate valid usernames and extract sensitive LDAP directory attributes through blind injection techniques. The vulnerability exists in Zitadel versions 2.71.11-2.71.19, 3.1.0-3.4.9, and 4.0.0-4.14.0 when LDAP is configured as an identity provider. Exploitation requires no authentication (CVSS PR:N) and has network attack vector (AV:N) with low complexity (AC:L), resulting in high confidentiality impact (C:H) but no authentication bypass capability. Vendor-released patches are available for 3.x (3.4.10) and 4.x (4.15.0) branches. No public exploit identified at time of analysis, though the attack technique is well-documented in security research.

Technical ContextAI

This vulnerability stems from improper neutralization of special elements in LDAP queries (CWE-90: LDAP Injection). Zitadel, an open-source identity and access management platform written in Go (pkg:go/github.com/zitadel/zitadel), integrates with LDAP directories as identity providers for authentication. The flaw occurs when user-supplied usernames from login forms are incorporated into LDAP search filter strings without proper sanitization or escaping. LDAP search filters use special metacharacters like parentheses, asterisks, and backslashes to construct query logic. By injecting these characters (e.g., transforming 'username' to 'user*' or 'user)(objectClass=*)'), attackers can modify the search filter's logical structure. This creates a blind injection scenario where attackers observe timing differences or error messages to infer directory contents. The vulnerability is specific to deployments using LDAP as an IdP backend, not affecting other authentication methods like OAuth or SAML.

RemediationAI

Upgrade to patched versions immediately: Zitadel 4.x users should upgrade to version 4.15.0 or later (https://github.com/zitadel/zitadel/releases/tag/v4.15.0), and Zitadel 3.x users should update to version 3.4.10 or later (https://github.com/zitadel/zitadel/releases/tag/v3.4.10). For Zitadel 2.x deployments (2.71.11-2.71.19), the vendor advisory indicates upgrading to 3.4.10 is the remediation path, as no 2.x patch is released. If immediate patching is not feasible, implement strict LDAP directory access controls to limit the scope of enumerable attributes - specifically, configure LDAP ACLs to prevent anonymous binds from reading sensitive user attributes beyond basic authentication fields, and consider IP allowlisting for LDAP queries to trusted Zitadel instances only. This workaround reduces information disclosure severity but does not eliminate username enumeration risk. Organizations not using LDAP as an identity provider are unaffected and require no action. Monitor application logs for unusual login patterns (rapid sequential failures with special characters in usernames) that may indicate exploitation attempts.