CVE-2026-85056: ZITADEL: MFA bypass via session reuse in Login V2
A vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor (TOTP, OTP, or U2F). An attacker who already knows valid credentials can fully authenticate to an application without completing MFA.
References
- github.com/advisories/GHSA-9993-rfwp-rhwf
- github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db
- github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43
- github.com/zitadel/zitadel/releases/tag/v4.16.1
- github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf
- nvd.nist.gov/vuln/detail/CVE-2026-85056
Code Behaviors & Features
Detect and mitigate CVE-2026-85056 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →