NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

ZITADEL has LDAP Filter Injection in Login FlowGHSA-rxvx-hhpj-q6px

HIGH

GHSA-rxvx-hhpj-q6px is a high-severity (CVSS 7.5) CWE-90 vulnerability in github.com/zitadel/zitadel. A fix is available for github.com/zitadel/zitadel — see the affected versions and patch details below.

Also known asCVE-2026-44671GO-2026-5648
Published
Updated
Affected
3 pkgs
Patched
2 / 3
Exploits
None indexed
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-rxvx-hhpj-q6px.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk-0.14%
Lower risk than most CVEs42th percentile — riskier than 42% of all scored CVEsHighest risk
0.00%0.37%0.74%1.12%0.1%0.5%0.5%0.6%0.5%Jun 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

3 pkgs affected
🐹github.com/zitadel/zitadel🐹github.com/zitadel/zitadel🐹github.com/zitadel/zitadel

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

A vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process.

Impact

While this vulnerability does not allow for a full authentication bypass, an attacker can use LDAP metacharacters (such as *, (, )) to perform blind LDAP injection. By observing the different failure (or success) responses, an attacker can systematically enumerate valid usernames and extract sensitive attribute data from the connected LDAP directory.

Note that an authentication bypass is not possible.

Affected Versions

Systems integrating LDAP as IdPs and running one of the following versions are affected:

  • 4.x: 4.0.0 through 4.14.0 (including RC versions)
  • 3.x: 3.1.0 through 3.4.9
  • 2.x: 2.71.11 through 2.71.19

Patches

The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.

Workarounds

The recommended solution is to upgrade to a patched version. If an immediate upgrade is not possible, developers should ensure their project's LDAP directory has strict access controls to limit the scope of information disclosure.

Questions

If there are any questions or comments about this advisory, please send an email to [email protected]

Credits

This vulnerability was identified and reported by ProScan AppSec (https://proscan.one/).

Affected Packages

3 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/zitadel/zitadel≥ 4.0.0&&< 4.15.04.15.0go get github.com/zitadel/zitadel@v4.15.0
🐹Gogithub.com/zitadel/zitadel≥ 2.71.11No fix
🐹Gogithub.com/zitadel/zitadel≥ 3.1.0&&< 3.4.103.4.10go get github.com/zitadel/zitadel@v3.4.10

Affected Products

1 product · 2 configurations
Application
zitadelzitadel
≥ 4.0.0 && < 4.15.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/zitadel/zitadel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/zitadel/zitadel to 4.15.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-rxvx-hhpj-q6px is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

## Summary A vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process. ## Impact While this vulnerability does not allow for a full authentication bypass, an attacker can use LDAP metacharacters (such as `*`, `(`, `)`) to perform blind LDAP injection. By observing the different failure (or success) responses, an attacker can systematically enumerate valid usernames an
O3 Security · Impact-Aware SCA

Is GHSA-rxvx-hhpj-q6px in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
ZITADEL has LDAP Filter Injection in Login Flow (High 7.5)