Vulnerability-Lookup

GHSA-9993-RFWP-RHWF

Vulnerability from github – Published: 2026-09-24 18:19 – Updated: 2026-09-24 18:19

Summary

ZITADEL: MFA bypass via session reuse in Login V2

Details

Summary

A vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor (TOTP, OTP, or U2F). An attacker who already knows valid credentials can fully authenticate to an application without completing MFA.

Impact

ZITADEL Login V2 issues a session as soon as the user’s password is verified, before the MFA challenge is completed. If the MFA step is abandoned (for example by navigating back) and login is started again, Login V2 may reuse that existing session instead of requiring the second factor.

Session validity checks only enforced MFA verification when the organization’s login policy had Force MFA (or Force MFA for local users only) enabled. They did not treat a voluntarily enrolled second factor as required. In the common case where MFA is available on the user but not organization-mandated, a password-only session was treated as fully authenticated and used to complete the OIDC or SAML callback, bypassing the user’s second factor.

Scope note: This issue affects customer applications that authenticate users through the hosted Login V2 UI (OIDC/SAML). It does not affect Login V1. It also does not affect authentication to ZITADEL itself — including the Console, the Management/Admin APIs, and user self-management — even when Login V2 is enabled.

Affected Versions

Systems running one of the following versions are affected:

4.x: 4.0.0 through 4.16.0 (including RC versions)

Patches

The vulnerability has been addressed in the latest releases. The patch ensures Login V2 validates that any second factor enrolled on the user has been verified before an existing session can be reused to complete authentication.

4.x: Upgrade to $\ge$ 4.16.1

Workarounds

If an immediate upgrade is not possible, enable Force MFA (or Force MFA for local users only, if you want to exempt IdP/federated logins) in the affected organization’s — or the instance default — login policy. This makes second-factor verification mandatory for password logins and closes this session-reuse bypass.

Note that this is a broader policy change (MFA becomes mandatory for the scoped local logins) rather than a narrow fix limited to users who already self-enrolled a second factor.

Questions

If you have any questions or comments about this advisory, please email us at security@zitadel.com

Credits

Thanks to Philippe Wechsler (@MadMonkey87) for finding and reporting the vulnerability.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.80.0-v2.20.0.20260717062356-56f4798ed31f"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-85056"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-24T18:19:35Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA vulnerability in ZITADEL\u2019s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user\u2019s enrolled second factor (TOTP, OTP, or U2F). An attacker who already knows valid credentials can fully authenticate to an application without completing MFA.\n\n### Impact\n\nZITADEL Login V2 issues a session as soon as the user\u2019s password is verified, before the MFA challenge is completed. If the MFA step is abandoned (for example by navigating back) and login is started again, Login V2 may reuse that existing session instead of requiring the second factor.\n\nSession validity checks only enforced MFA verification when the organization\u2019s login policy had **Force MFA** (or **Force MFA for local users only**) enabled. They did not treat a voluntarily enrolled second factor as required. In the common case where MFA is available on the user but not organization-mandated, a password-only session was treated as fully authenticated and used to complete the OIDC or SAML callback, bypassing the user\u2019s second factor.\n\n**Scope note:** This issue affects **customer applications** that authenticate users through the hosted **Login V2** UI (OIDC/SAML). It does **not** affect Login V1. It also does **not** affect authentication to ZITADEL itself \u2014 including the Console, the Management/Admin APIs, and user self-management \u2014 even when Login V2 is enabled.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.16.0` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch ensures Login V2 validates that any second factor enrolled on the user has been verified before an existing session can be reused to complete authentication.\n\n* **4.x**: Upgrade to $\\ge$ [4.16.1](https://github.com/zitadel/zitadel/releases/tag/v4.16.1)\n\n### Workarounds\n\nIf an immediate upgrade is not possible, enable **Force MFA** (or **Force MFA for local users only**, if you want to exempt IdP/federated logins) in the affected organization\u2019s \u2014 or the instance default \u2014 login policy. This makes second-factor verification mandatory for password logins and closes this session-reuse bypass.\n\nNote that this is a broader policy change (MFA becomes mandatory for the scoped local logins) rather than a narrow fix limited to users who already self-enrolled a second factor.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Philippe Wechsler ([@MadMonkey87](https://github.com/MadMonkey87)) for finding and reporting the vulnerability.",
  "id": "GHSA-9993-rfwp-rhwf",
  "modified": "2026-09-24T18:19:35Z",
  "published": "2026-09-24T18:19:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zitadel/zitadel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v4.16.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ZITADEL: MFA bypass via session reuse in Login V2"
}

CVE-2026-85056 (GCVE-0-2026-85056)

Vulnerability from cvelistv5 – Published: 2026-09-24 17:34 – Updated: 2026-09-24 17:34

Title

ZITADEL: MFA bypass via session reuse in Login V2

Summary

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/zitadel/zitadel/security/advis…	x_refsource_CONFIRM
https://github.com/zitadel/zitadel/commit/049dbb2…	x_refsource_MISC
https://github.com/zitadel/zitadel/commit/56f4798…	x_refsource_MISC
https://github.com/zitadel/zitadel/releases/tag/v4.16.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zitadel	zitadel	Affected: >= 4.0.0, < 4.16.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "zitadel",
          "vendor": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.16.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user\u0027s enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T17:34:13.328Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v4.16.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v4.16.1"
        }
      ],
      "source": {
        "advisory": "GHSA-9993-rfwp-rhwf",
        "discovery": "UNKNOWN"
      },
      "title": "ZITADEL: MFA bypass via session reuse in Login V2"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-85056",
    "datePublished": "2026-09-24T17:34:13.328Z",
    "dateReserved": "2026-09-02T21:21:01.774Z",
    "dateUpdated": "2026-09-24T17:34:13.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-9993-RFWP-RHWF

Summary

Impact

Affected Versions

Patches

Workarounds

Questions

Credits

CVE-2026-85056 (GCVE-0-2026-85056)

Tags

Sightings

Nomenclature

Related by attack behaviour