VYPR
← All advisories
Medium severity5.7NVD Advisory· Published Jul 3, 2024· Updated Jun 17, 2026

CVE-2024-39683

CVE-2024-39683

Description

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions. Versions 2.55.1, 2.54.5, and 2.53.8 contain a fix for the issue. There is no workaround since a patch is already available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/zitadel/zitadelGo
>= 2.0.0, < 2.53.82.53.8
github.com/zitadel/zitadelGo
>= 2.54.0, < 2.54.52.54.5
github.com/zitadel/zitadelGo
>= 2.55.0, < 2.55.12.55.1

Affected products

5
  • Zitadel/Zitadel4 versions
    cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*range: >=2.53.0,<2.53.8
    • cpe:2.3:a:zitadel:zitadel:2.55.0:-:*:*:*:*:*:*
    • cpe:2.3:a:zitadel:zitadel:2.55.0:rc1:*:*:*:*:*:*
    • (no CPE)range: = 2.55.0
  • ghsa-coords
    pkg:golang/github.com/zitadel/zitadel
    Range: >= 2.0.0, < 2.53.8

Patches

Vulnerability mechanics

References

12

News mentions

0

No linked articles in our index yet.