Summary
A missing authentication vulnerability in ZITADEL's hosted Login V1 UI allows an unauthenticated requester to invoke the change-username flow before any identity factor is verified.
By supplying a victim's login name and submitting a replacement username, an attacker may rename an active human account, potentially locking out the user, including an administrator.
A missing authentication vulnerability in ZITADEL's hosted Login V1 UI allows an unauthenticated requester to invoke the change-username flow before any identity factor is verified.
By supplying a victim's login name and submitting a replacement username, an attacker may rename an active human account, potentially locking out the user, including an administrator.
Affected context
The issue occurs in deployments using the hosted Login V1 UI when the change-username handler trusts the account associated with a login flow before authentication or factor verification has completed. It is most concerning where the Login V1 endpoint is publicly reachable and account usernames are discoverable or guessable.
The issue occurs in deployments using the hosted Login V1 UI when the change-username handler trusts the account associated with a login flow before authentication or factor verification has completed. It is most concerning where the Login V1 endpoint is publicly reachable and account usernames are discoverable or guessable.
Exploit preconditions
- Attack surface: Hosted Login V1 UI and its change-username handler
- Required access: No authenticated account access is required; the attacker generally needs a victim's login name
- Trigger point: A username-change request associated with an incomplete login flow
- Why exploitation is possible: The handler acts on the login-flow account before requiring verification of an authentication factor
- Attack surface: Hosted Login V1 UI and its change-username handler
- Required access: No authenticated account access is required; the attacker generally needs a victim's login name
- Trigger point: A username-change request associated with an incomplete login flow
- Why exploitation is possible: The handler acts on the login-flow account before requiring verification of an authentication factor
Why this happens
The underlying bug is an authorization-ordering failure mapped to CWE-306: Missing Authentication for Critical Function. A sensitive account-management operation is permitted based on a preliminary login-flow association rather than a successfully authenticated session or verified factor. This insecure pattern allows an unauthenticated request to modify account state that should be protected by completed authentication and authorization checks.
The underlying bug is an authorization-ordering failure mapped to CWE-306: Missing Authentication for Critical Function. A sensitive account-management operation is permitted based on a preliminary login-flow association rather than a successfully authenticated session or verified factor. This insecure pattern allows an unauthenticated request to modify account state that should be protected by completed authentication and authorization checks.
Potential impact
- An attacker may rename active human user accounts
- Victims could be locked out because their expected login name no longer works
- Administrative users may lose access to management functions
- Account-recovery workload and identity confusion could increase
- Follow-on compromise could occur if account control is later regained or combined with another weakness
- An attacker may rename active human user accounts
- Victims could be locked out because their expected login name no longer works
- Administrative users may lose access to management functions
- Account-recovery workload and identity confusion could increase
- Follow-on compromise could occur if account control is later regained or combined with another weakness
General mitigation guidance
Mitigation generally focuses on ensuring that account-management operations require completed authentication and explicit authorization.
Common defensive patterns include:
- Require a verified authentication factor before processing username changes
- Bind sensitive account changes to an authenticated session, not merely an unverified login flow
- Apply authorization checks immediately before changing account identity attributes
- Use step-up authentication and reauthentication for high-impact account modifications
- Restrict username changes through secure, auditable administrative workflows where appropriate
- Provide notifications, audit records, and recovery controls for identity changes
- Apply least privilege and prevent unauthenticated endpoints from reaching account mutation logic
Mitigation generally focuses on ensuring that account-management operations require completed authentication and explicit authorization.
Common defensive patterns include:
- Require a verified authentication factor before processing username changes
- Bind sensitive account changes to an authenticated session, not merely an unverified login flow
- Apply authorization checks immediately before changing account identity attributes
- Use step-up authentication and reauthentication for high-impact account modifications
- Restrict username changes through secure, auditable administrative workflows where appropriate
- Provide notifications, audit records, and recovery controls for identity changes
- Apply least privilege and prevent unauthenticated endpoints from reaching account mutation logic
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks for account mutations reachable before authentication completion
- Review of handlers that use login-flow state as a substitute for an authenticated principal
- Tests that invoke sensitive identity-management actions at each stage of an incomplete login flow
- Runtime monitoring for unauthenticated username-change requests and unusual administrative account renames
- Policy enforcement requiring authentication and authorization middleware on account-management routes
- Automated security testing that verifies step-up authentication for high-impact identity changes
Organizations can look for this class of issue through:
- Static analysis and code review checks for account mutations reachable before authentication completion
- Review of handlers that use login-flow state as a substitute for an authenticated principal
- Tests that invoke sensitive identity-management actions at each stage of an incomplete login flow
- Runtime monitoring for unauthenticated username-change requests and unusual administrative account renames
- Policy enforcement requiring authentication and authorization middleware on account-management routes
- Automated security testing that verifies step-up authentication for high-impact identity changes
