CVE-2025-31124

Summary

CVE-2025-31124 is a vulnerability affecting Zitadel, an open-source identity infrastructure software. When the "Ignoring unknown usernames" setting is enabled, Zitadel will show a password prompt even if the user doesn't exist, reporting "Username or Password invalid". However, the vulnerability arises from the normalization of usernames during the login process, which inadvertently discloses the existence of non-existent users. This issue has been addressed in multiple Zitadel versions, including 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.