{"id":"EUVD-2026-86324","enisaUuid":"edddc2db-1cf9-3c50-ab51-5fe907eb176b","description":"ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user\u0027s enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.","datePublished":"Sep 24, 2026, 5:34:13 PM","dateUpdated":"Sep 28, 2026, 2:56:04 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf\nhttps://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db\nhttps://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43\nhttps://github.com/zitadel/zitadel/releases/tag/v4.16.1\n","aliases":"CVE-2026-85056\nGHSA-9993-rfwp-rhwf\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"ec87d990-22d7-3d1c-9a99-345a848d1af0","product":{"name":"zitadel","vendor":{"name":"zitadel"}},"product_version":"4.0.0, \u003c 4.16.1"}],"enisaIdVendor":[{"id":"d229f945-9ba2-3366-ab4e-ff676495561b","vendor":{"name":"zitadel"}}],"enisaIdVulnerability":[{"id":"3f6ca0b8-57c3-36a7-856c-af9828245bc7","vulnerability":{"id":"GHSA-9993-rfwp-rhwf","description":"ZITADEL: MFA bypass via session reuse in Login V2","datePublished":"Sep 24, 2026, 6:19:35 PM","dateUpdated":"Sep 24, 2026, 6:19:35 PM","baseScore":0.0,"references":"https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf\nhttps://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db\nhttps://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43\nhttps://github.com/zitadel/zitadel\nhttps://github.com/zitadel/zitadel/releases/tag/v4.16.1\n","enisa_id":"EUVD-2026-86324\n","aliases":"GHSA-9993-rfwp-rhwf\nCVE-2026-85056\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"78f90077-52a8-3cc1-8855-957613aa99f6","vulnerability":{"id":"CVE-2026-85056","description":"ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user\u0027s enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.","datePublished":"Sep 24, 2026, 5:34:13 PM","dateUpdated":"Sep 28, 2026, 2:56:04 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf\nhttps://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db\nhttps://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43\nhttps://github.com/zitadel/zitadel/releases/tag/v4.16.1\n","enisa_id":"EUVD-2026-86324\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Nov 9, 2026, 3:07:55 PM","vulnerabilityProduct":[{"id":"a96517ad-2334-32c5-98dd-d0610c9b0ecc","product":{"name":"zitadel","vendor":{"name":"zitadel"}},"product_version":"4.0.0, \u003c 4.16.1"}],"vulnerabilityVendor":[{"id":"b1c65107-b46c-3734-8596-1fcb6de5a89b","vendor":{"name":"zitadel"}}]}}],"enisaIdAdvisory":[]}