{"id":"CVE-2026-85056","kind":"vulnerability","aliases":["CVE-2026-85056","GHSA-9993-rfwp-rhwf","GO-2026-6589"],"related":[],"title":"ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel","description":"ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.","summary":"ZITADEL Login V2 can reuse a browser session created after password verification, letting a user with a voluntarily enrolled TOTP, OTP, or U2F factor skip the second factor during a later OIDC or SAML login. An attacker who knows a victim's password could sign in to customer applications without the second factor.","severity":"high","cvss":8.2,"epss":0.00285,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/zitadel/zitadel","fixed":["1.80.0-v2.20.0.20260717062356-56f4798ed31f"],"affected":"< 1.80.0-v2.20.0.20260717062356-56f4798ed31f","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","oidc","package","saml","self-hosted","zitadel"],"not_affected_if":["force-mfa-enabled","login-v1-only","managed-hosting-already-patched","no-voluntary-mfa-enrolled"],"how_to_check":"Check the Go module version of github.com/zitadel/zitadel in go.mod; affected if below 1.80.0-v2.20.0.20260717062356-56f4798ed31f. Self-hosted ZITADEL 4.0.0 through 4.16.1 is affected; check the running ZITADEL version.","fix":"Upgrade to ZITADEL 4.16.1 or the fixed module version 1.80.0-v2.20.0.20260717062356-56f4798ed31f.\nUntil upgraded, enable Force MFA for the organization, since the bypass only applies when Force MFA is not set.","status":"open","published_at":"2026-09-24T18:19:04+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:43+00:00","updated_at":"2026-10-23T19:52:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:52:43Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to ZITADEL 4.16.1 or the fixed module version 1.80.0-v2.20.0.20260717062356-56f4798ed31f.\nUntil upgraded, enable Force MFA for the organization, since the bypass only applies when Force MFA is not set.","summary":"ZITADEL Login V2 can reuse a browser session created after password verification, letting a user with a voluntarily enrolled TOTP, OTP, or U2F factor skip the second factor during a later OIDC or SAML login. An attacker who knows a victim's password could sign in to customer applications without the second factor.","category":"package","who_cares":["zitadel","self-hosted","oidc","saml","go"],"confidence":0.8,"analyst_note":"","how_to_check":"Check the Go module version of github.com/zitadel/zitadel in go.mod; affected if below 1.80.0-v2.20.0.20260717062356-56f4798ed31f. Self-hosted ZITADEL 4.0.0 through 4.16.1 is affected; check the running ZITADEL version.\nunknown","needs_analyst":false,"not_affected_if":["login-v1-only","force-mfa-enabled","no-voluntary-mfa-enrolled","managed-hosting-already-patched"],"severity_if_unknown":"high"},"cost_usd":0.000458,"input_tokens":2323,"output_tokens":452,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A,26A '-6589':24A '-85056':16A,27A '-9993':18A '/zitadel/zitadel':13A,30A '4.0.0':101C '4.16.1':103C,208C 'abandon':141C 'admin':192C 'affect':201C 'api':193C 'applic':87B,184C 'attack':75B 'authent':122C 'browser':45B,109C 'bypass':3A 'callback':180C 'check':149C 'complet':175C 'consol':189C 'could':82B 'creat':47B,107C 'custom':86B,183C 'cve':14A,25A 'enabl':156C 'enrol':57B,129C,169C 'factor':62B,66B,91B,135C,170C 'fix':205C 'forc':157C,160C 'ghsa':17A 'github.com':12A,29A 'github.com/zitadel/zitadel':11A,28A 'go':22A,31B 'host':37B 'ident':97C 'issu':203C 'know':77B 'later':69B,121C 'let':51B 'local':163C 'login':8A,40B,73B,105C,143C,185C 'manag':98C,190C,198C 'mfa':2A,138C,151C,158C,161C 'oidc':32B,70B,177C 'open':95C 'organ':155C 'otp':59B,131C 'packag':33B 'password':49B,81B,112C 'platform':99C 'request':123C 'requir':150C 'reus':6A,43B,116C 'rfwp':20A 'rfwp-rhwf':19A 'rhwf':21A 'saml':34B,72B,179C 'second':65B,90B,134C 'self':36B,197C 'self-host':35B 'self-manag':196C 'session':5A,46B,110C,118C,147C 'session-valid':146C 'sign':83B 'skip':63B,173C 'sourc':96C 'start':144C 'step':139C 'totp':58B,130C 'u2f':61B,133C 'user':53B,127C,164C,195C 'v1':186C 'v2':9A,41B,106C 'valid':148C 'verif':50B,113C 'verifi':125C 'version':207C 'via':4A 'victim':79B 'voluntarili':56B,168C 'without':88B,124C 'zitadel':1A,38B,39B,92C,104C,188C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-24T18:19:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6589","url":"https://pkg.go.dev/vuln/GO-2026-6589","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-85056","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85056","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-85056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85056","severity":null,"published_at":"2026-09-24T18:19:04+00:00","modified_at":"2026-09-28T15:17:24+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}