Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-3rmw-76m6-4gjc: User Registration Bypass in Zitadel

Impact

Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.63.4, disabling the “User Registration allowed” option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way.

Patches

2.x versions are fixed on >= 2.64.0 2.63.x versions are fixed on >= 2.63.5 2.62.x versions are fixed on >= 2.62.7 2.61.x versions are fixed on >= 2.61.4 2.60.x versions are fixed on >= 2.60.4 2.59.x versions are fixed on >= 2.59.5 2.58.x versions are fixed on >= 2.58.7

Workarounds

Updating to the patched version is the recommended solution.

Questions

If you have any questions or comments about this advisory, please email us at [email protected]

Credits

Thanks to @sevensolutions and @evilgensec for disclosing this!

ghsa
Open in Source
#vulnerability#web#git

Skip to content

Navigation Menu

    • GitHub Copilot

      Write better code with AI

    • Security

      Find and fix vulnerabilities

    • Actions

      Automate any workflow

    • Codespaces

      Instant dev environments

    • Issues

      Plan and track work

    • Code Review

      Manage code changes

    • Discussions

      Collaborate outside of code

    • Code Search

      Find more, search less

  • Explore

    • Learning Pathways
    • White papers, Ebooks, Webinars
    • Customer Stories
    • Partners

    • GitHub Sponsors

      Fund open source developers

*   The ReadME Project
    
    GitHub community articles

    • Enterprise platform

      AI-powered developer platform

  • Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

  1. GitHub Advisory Database
  2. GitHub Reviewed
  3. CVE-2024-49757

User Registration Bypass in Zitadel

High severity GitHub Reviewed Published Oct 25, 2024 in zitadel/zitadel • Updated Oct 25, 2024

Package

gomod github.com/zitadel/zitadel (Go)

Affected versions

>= 2.63.0, < 2.63.5

>= 2.62.0, < 2.62.7

>= 2.61.0, < 2.61.4

>= 2.60.0, < 2.60.4

>= 2.59.0, < 2.59.5

< 2.58.7

Patched versions

2.63.5

2.62.7

2.61.4

2.60.4

2.59.5

2.58.7

Description

Published to the GitHub Advisory Database

Oct 25, 2024

Last updated

Oct 25, 2024

ghsa: Latest News

GHSA-27wf-5967-98gx: Kubernetes kubelet arbitrary command execution
ghsa