CVE-2026-85056 Details
Description
ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.
A vulnerability in ZITADEL's Login V2 interface allows users to reuse a password-verified session for subsequent authentication requests without revalidating their enrolled multi-factor authentication (MFA) methods, such as TOTP, OTP, or U2F. This issue affects ZITADEL versions 4.0.0 to 4.16.0. The flaw arises because Login V2 issues a session immediately after password verification, prior to completing the MFA challenge. If the MFA step is skipped and login is restarted, the existing session may be reused, bypassing the second factor requirement. This vulnerability is particularly concerning for customer applications using OIDC or SAML, as it can lead to unauthorized access by exploiting the session reuse.
Users can upgrade to ZITADEL version 4.16.1 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, organizations can enable 'Force MFA' or 'Force MFA for local users only' in their login policy to make second-factor verification mandatory, closing the session-reuse bypass.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43 | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/releases/tag/v4.16.1 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZITADEL | >= 4.0.0, <= 4.16.0 (semver) |
CPE
Remediation
| |
| ZITADEL Login | >= 4.0.0, <= 4.16.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |