GHSA-9993-rfwp-rhwfPublished

ZITADEL: MFA bypass via session reuse in Login V2

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-85056

Published

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

Source published: 24 Sep 2026 17:34:13 UTC
Source modified: 28 Sep 2026 14:56:04 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

euvd · EUVD-2026-86324

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 24, 2026, 5:34:13 PM

dateUpdated: Sep 28, 2026, 2:56:04 PM

Source published: Sep 24, 2026, 5:34:13 PM (timezone not stated)
Source modified: Sep 28, 2026, 2:56:04 PM (timezone not stated)
Observed here: 11 Nov 2026 17:01:42 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

nvd · CVE-2026-85056

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-287

Original publisher date fields

published: 2026-09-24T18:19:04.040

lastModified: 2026-09-28T15:17:24.163

Source published: 24 Sep 2026 18:19:04 UTC
Source modified: 28 Sep 2026 15:17:24 UTC
Observed here: 25 Oct 2026 16:19:16 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

osv · GHSA-9993-rfwp-rhwf

Published

### Summary A vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor (TOTP, OTP, or U2F). An attacker who already knows valid credentials can fully authenticate to an application without completing MFA. ### Impact ZITADEL Login V2 issues a session as soon as the user’s password is verified, before the MFA challenge is completed. If the MFA step is abandoned (for example by navigating back) and login is started again, Login V2 may reuse that existing session instead of requiring the second factor. Session validity checks only enforced MFA verification when the organization’s login policy had **Force MFA** (or **Force MFA for local users only**) enabled. They did not treat a voluntarily enrolled second factor as required. In the common case where MFA is available on the user but not organization-mandated, a password-only session was treated as fully authenticated and used to complete the OIDC or SAML callback, bypassing the user’s second factor. **Scope note:** This issue affects **customer applications** that authenticate users through the hosted **Login V2** UI (OIDC/SAML). It does **not** affect Login V1. It also does **not** affect authentication to ZITADEL itself — including the Console, the Management/Admin APIs, and user self-management — even when Login V2 is enabled. ### Affected Versions Systems running one of the following versions are affected: * **4.x:** `4.0.0` through `4.16.0` (including RC versions) ### Patches The vulnerability has been addressed in the latest releases. The patch ensures Login V2 validates that any second factor enrolled on the user has been verified before an existing session can be reused to complete authentication. * **4.x**: Upgrade to $\ge$ [4.16.1](https://github.com/zitadel/zitadel/releases/tag/v4.16.1) ### Workarounds If an immediate upgrade is not possible, enable **Force MFA** (or **Force MFA for local users only**, if you want to exempt IdP/federated logins) in the affected organization’s — or the instance default — login policy. This makes second-factor verification mandatory for password logins and closes this session-reuse bypass. Note that this is a broader policy change (MFA becomes mandatory for the scoped local logins) rather than a narrow fix limited to users who already self-enrolled a second factor. ### Questions If you have any questions or comments about this advisory, please email us at [[email protected]](mailto:[email protected]) ### Credits Thanks to Philippe Wechsler ([@MadMonkey87](https://github.com/MadMonkey87)) for finding and reporting the vulnerability.

Source published: 24 Sep 2026 18:19:35 UTC
Source modified: 1 Oct 2026 20:56:14 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Publisher rating · HIGH

osv · GO-2026-6589

Published

ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel

Source published: 1 Oct 2026 20:23:38 UTC
Source modified: 1 Oct 2026 20:45:15 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.