Description
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.
Published: 2026-11-13
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to version 1.11.0

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 13 Nov 2026 15:45:00 +0000

Type Values Removed Values Added
Description The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.
Title Zenitel Connect login allows username enumeration via verbose error responses
Weaknesses CWE-204
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Zenitel

Published:

Updated: 2026-11-13T15:37:28.294Z

Reserved: 2026-10-05T17:24:32.718Z

Link: CVE-2026-105671

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-13T16:17:23.350

Modified: 2026-11-13T16:17:23.350

Link: CVE-2026-105671

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses