GO-2026-6589 ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel

ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...

GHSA-9993-RFWP-RHWF ZITADEL: MFA bypass via session reuse in Login V2

Summary A vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor TOTP, OTP, or U2F. An attacker who already knows valid credentials can fully authenticate to an applicatio...

ZITADEL: MFA bypass via session reuse in Login V2

Summary A vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor TOTP, OTP, or U2F. An attacker who already knows valid credentials can fully authenticate to an applicatio...

CVE-2026-85056

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056

The identity management platform ZITADEL is vulnerable to an MFA bypass in Login V2 (versions 4.0.0 through 4.16.1). The root cause is that the system creates a browser session after password verification and allows it to be reused for subsequent requests without verifying enrolled TOTP, OTP, or ...

CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

EUVD-2026-86324

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056: Improper Authentication

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

PT-2026-98200

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.16.0 Description ZITADEL Login V2 creates a browser session immediately after password verification. This session can be reused for subsequent authentication requests without verifying a user's enrolled second...

CVE-2026-56667

ZITADEL, an open source identity management platform, contains a Stored XSS flaw prior to version 4.15.3 in the Login V2 OIDC and SAML FailedPrecondition error paths. The bug returns loginSettings.defaultRedirectUri to router.push without applying isSafeRedirectUri, enabling an organization or in...

CVE-2026-56667: Improper Neutralization of Input During Web Page Generation

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a...

SUSE CVE-2026-33132

ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes urn:zitadel:iam:org:id:...

CVE-2026-33132

CVE-2026-33132 concerns Zitadel, an open source identity management platform. Connected advisories confirm a missing enforcement of organization scopes in Zitadel’s authentication flow, enabling a bypass of organization checks for users during sign-in. Affected components include the Zitadel core...

CVE-2026-33132 ZITADEL is missing enforcement of organization scopes

ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes urn:zitadel:iam:org:id:...

CVE-2026-33132: Incorrect Authorization

ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes urn:zitadel:iam:org:id:...

CVE-2026-29192

Technical details for CVE-2026-29192 are not provided in the connected documents. No specifics on affected products beyond Zitadel 4.0.0–4.11.1 or remediation beyond patch to 4.12.0. Monitor for official advisories and updates.

CVE-2026-29193: Improper Authentication

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel's login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their...

CVE-2026-29191: Improper Neutralization of Input During Web Page Generation

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0...