Description
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
zitadel zitadel
Default version status: unaffected
3.0.0 to < 4.18.0affected4.18.0unaffected
pkg:golang/github.com/zitadel/zitadel