Live › vulnerability › CVE-2026-85056
Go to dashboardZITADEL Login V2 can reuse a browser session created after password verification, letting a user with a voluntarily enrolled TOTP, OTP, or U2F factor skip the second factor during a later OIDC or SAML login. An attacker who knows a victim's password could sign in to customer applications without the second factor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/zitadel/zitadel | go | < 1.80.0-v2.20.0.20260717062356-56f4798ed31f | 1.80.0-v2.20.0.20260717062356-56f4798ed31f |
1.80.0-v2.20.0.20260717062356-56f4798ed31f4.0.0 through 4.16.1 is affected; check the running ZITADEL version4.16.1 or the fixed module version 1.80.0-v2.20.0.20260717062356-56f4798ed31fEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-85056")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.