---
id: "CVE-2026-85056"
kind: "vulnerability"
aliases: ["CVE-2026-85056", "GHSA-9993-rfwp-rhwf", "GO-2026-6589"]
title: "ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel"
severity: "high"
cvss: 8.2
epss: 0.00285
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/zitadel/zitadel", "fixed": ["1.80.0-v2.20.0.20260717062356-56f4798ed31f"], "affected": "< 1.80.0-v2.20.0.20260717062356-56f4798ed31f", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "oidc", "package", "saml", "self-hosted", "zitadel"]
not_affected_if: ["force-mfa-enabled", "login-v1-only", "managed-hosting-already-patched", "no-voluntary-mfa-enrolled"]
published_at: "2026-09-24T18:19:04+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:52:43+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6589", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-85056", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85056", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel

ZITADEL Login V2 can reuse a browser session created after password verification, letting a user with a voluntarily enrolled TOTP, OTP, or U2F factor skip the second factor during a later OIDC or SAML login. An attacker who knows a victim's password could sign in to customer applications without the second factor.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/zitadel/zitadel affected < 1.80.0-v2.20.0.20260717062356-56f4798ed31f fixed 1.80.0-v2.20.0.20260717062356-56f4798ed31f

## How to check

Check the Go module version of github.com/zitadel/zitadel in go.mod; affected if below 1.80.0-v2.20.0.20260717062356-56f4798ed31f. Self-hosted ZITADEL 4.0.0 through 4.16.1 is affected; check the running ZITADEL version.

## Fix

Upgrade to ZITADEL 4.16.1 or the fixed module version 1.80.0-v2.20.0.20260717062356-56f4798ed31f.
Until upgraded, enable Force MFA for the organization, since the bypass only applies when Force MFA is not set.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6589
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-85056
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85056

## From the sources

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_