GHSA-3rmw-76m6-4gjc CVE-2024-49757 GO-2024-3217

User Registration Bypass in Zitadel

Medium Go

Severity: 7.5 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 2.52%; Chance of exploitation in the next 30 days. Higher than 84.83% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-287 Improper Authentication
Fix: 2.63.5; Upgrade github.com/zitadel/zitadel to this version or later

Description

Impact

Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.63.4, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way.

Patches

2.x versions are fixed on >= 2.64.0 2.63.x versions are fixed on >= 2.63.5 2.62.x versions are fixed on >= 2.62.7 2.61.x versions are fixed on >= 2.61.4 2.60.x versions are fixed on >= 2.60.4 2.59.x versions are fixed on >= 2.59.5 2.58.x versions are fixed on >= 2.58.7

Workarounds

Updating to the patched version is the recommended solution.

Questions

If you have any questions or comments about this advisory, please email us at security@zitadel.com

Credits

Thanks to @sevensolutions and @evilgensec for disclosing this!

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/zitadel/zitadel	`>= 2.63.0, < 2.63.5`	`2.63.5`
github.com/zitadel/zitadel	`>= 2.62.0, < 2.62.7`	`2.62.7`
github.com/zitadel/zitadel	`>= 2.61.0, < 2.61.4`	`2.61.4`
github.com/zitadel/zitadel	`>= 2.60.0, < 2.60.4`	`2.60.4`
github.com/zitadel/zitadel	`>= 2.59.0, < 2.59.5`	`2.59.5`
github.com/zitadel/zitadel	`< 2.58.7`	`2.58.7`
github.com/zitadel/zitadel	`all versions`	No fix yet

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/zitadel/zitadel Go → `2.63.5`

go

go get github.com/zitadel/zitadel@v2.63.5 && go mod tidy

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it

Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2024-49757

Packages

github.com/zitadel/zitadel

Timeline

Oct 25, 2024 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-fgmf-7rf8-m6vf ZITADEL: Actions V1 sandbox escape: host file read via require()	High	Also affects github.com/zitadel/zitadel
GHSA-9993-rfwp-rhwf ZITADEL: MFA bypass via session reuse in Login V2	High	Also affects github.com/zitadel/zitadel
GHSA-v859-c572-qh5p ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions	Medium	Also affects github.com/zitadel/zitadel
GHSA-jq8w-8q2f-ffm9 ZITADEL Users Can Self-Verify Email/Phone via API	High	Also affects github.com/zitadel/zitadel
GHSA-vrh8-c9cm-wh8v ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange	High	Also affects github.com/zitadel/zitadel
GHSA-992q-9gwp-7r79 ZITADEL: Auto-linking by email: IdP-side email verification is not checked	Medium	Also affects github.com/zitadel/zitadel
GHSA-v77h-2w3m-94hx ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider	Medium	Also affects github.com/zitadel/zitadel
GHSA-g5h5-m4hm-xjrr ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider	Medium	Also affects github.com/zitadel/zitadel

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor