Product
An unauthenticated access vulnerability in ZITADEL versions 3.0.0 through 4.17.x allows remote attackers to rename arbitrary user accounts via the change-username handler, resulting in administrative account lockout.