CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

What is CVE-2026-85056?

CVE-2026-85056 is a high-severity authentication bypass vulnerability in zitadel, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

Weakness: CWE-287

Which versions are affected by CVE-2026-85056?

3 open source packages ship an affected version, including github.com/zitadel/zitadel.

How do I fix CVE-2026-85056?

Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260717062356-56f4798ed31f or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-85056 being exploited?

There is no known exploitation of CVE-2026-85056 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9993-rfwp-rhwf, GO-2026-6589.