CVE-2026-85056— ZITADEL: MFA bypass via session reuse in Login V2
Quick assessment
Affected
zitadel zitadel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ZITADEL 是一个开源的身份管理平台。在版本 4.0.0 至 4.16.1 之间，ZITADEL 的 Login V2 功能在验证用户密码后会创建一个浏览器会话，并可在后续的认证请求中重用该会话，而无需验证用户已注册的 TOTP、OTP 或 U2F 等第二因素身份验证方法。 当多因素身份验证（MFA）步骤被中止并重新登录时，只有当组织启用了“强制 MFA”（Force MFA）或“仅对本地用户强制 MFA”时，会话有效性检查才会要求执行 MFA。因此，在为用户应用完成 OIDC 或 SAML 回调时，可以跳过用
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85056
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ZITADEL: MFA bypass via session reuse in Login V2
Source: CVE Program / CVE List V5
Vulnerability Description
ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-85056
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85056
请登录查看更多情报信息。
Other References for CVE-2026-85056 (4)
-
https://github.com/zitadel/zitadel/releases/tag/v4.16.1 x_refsource_MISC
-
https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: zitadel
-
CVE-2026-85057
ZITADEL: Actions V1 sandbox escape: host file read via requi -
CVE-2026-76081
ZITADEL: Improper Role Revocation on Granted Projects during -
CVE-2026-54693
ZITADEL Users Can Self-Verify Email/Phone via API -
CVE-2026-56668
ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 T -
CVE-2026-56666
ZITADEL: Auto-linking by email: IdP-side email verification
Same vendor: zitadel
-
CVE-2026-85057
ZITADEL: Actions V1 sandbox escape: host file read via requi -
CVE-2026-76081
ZITADEL: Improper Role Revocation on Granted Projects during -
CVE-2026-54693
ZITADEL Users Can Self-Verify Email/Phone via API -
CVE-2026-56668
ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 T -
CVE-2026-56666
ZITADEL: Auto-linking by email: IdP-side email verification
Same weakness: CWE-287
-
CVE-2026-101073
Netcore NR289-GE CGI Dispatcher boa improper authentication -
CVE-2026-52749
Improper Authentication in Kaon AR2140X -
CVE-2026-100886
Seetong T8108/T8108P/T8116/T8232 Debug Service improper auth -
CVE-2026-101050
Heym before 0.0.53 Authentication Bypass via Telegram Webhoo -
CVE-2026-101049
Heym before 0.0.53 Slack Webhook Signature Verification Bypa
V. Comments for CVE-2026-85056
No comments yet