CVE-2026-105671 · Other
NO FIX YET · SEE WHAT TO DO
The login page in Zenitel Connect before 1.11.0 returns different error messages for existing and non-existing usernames. An remote attacker can use crafted login requests to learn which accounts are valid, which helps them target password guessing.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running Zenitel Connect versions before 1.11.0 with a reachable login page. The sources do not describe further configuration conditions. unknown
Not affected if version-1.11.0-or-later
Who cares zenitel-connect
1.11.01.11.0 or laterThe login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.