{"cve":"CVE-2026-44671","nvd":{"published":"2026-05-14T22:16:44.850","modified":"2026-06-17T10:51:13.390","status":"Analyzed","description":"ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process. While this vulnerability does not allow for a full authentication bypass, an attacker can use LDAP metacharacters (such as *, (, )) to perform blind LDAP injection. By observing the different failure (or success) responses, an attacker can systematically enumerate valid usernames and extract sensitive attribute data from the connected LDAP directory. This vulnerability is fixed in 3.4.10 and 4.15.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-90"],"references":["https://github.com/zitadel/zitadel/releases/tag/v3.4.10","https://github.com/zitadel/zitadel/releases/tag/v4.15.0","https://github.com/zitadel/zitadel/security/advisories/GHSA-rxvx-hhpj-q6px"],"products":["zitadel:zitadel"],"source":"nvd","synced_at":"2026-10-19T22:35:16.954578616+00:00"},"epss":{"cve":"CVE-2026-44671","score":0.00479,"percentile":0.41369,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-rxvx-hhpj-q6px","url":"https://osv.dev/vulnerability/GHSA-rxvx-hhpj-q6px","summary":"ZITADEL has LDAP Filter Injection in Login Flow","modified":"2026-06-25T23:11:09.181966797Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=4.0.0 <4.15.0"],"fixed":["4.15.0"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.71.11 <=2.71.19"],"fixed":[]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=3.1.0 <3.4.10"],"fixed":["3.4.10"]}]},{"id":"GO-2026-5648","url":"https://osv.dev/vulnerability/GO-2026-5648","summary":"ZITADEL has LDAP Filter Injection in Login Flow in github.com/zitadel/zitadel","modified":"2026-06-25T23:01:37.458179714Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}