CVE-2026-85056
Description
ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.
How to fix
- github.com/zitadel/zitadel1.80.0-v2.20.0.20260717062356-56f4798ed31f or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/zitadel/zitadelGo | v < 1.80.0-v2.20.0.20260717062356-56f4798ed31f | 1.80.0-v2.20.0.20260717062356-56f4798ed31f |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.