CVE-2026-85056: ZITADEL MFA Authentication Bypass Vulnerability

CVE-2026-85056 Overview

ZITADEL is an open source identity and access management platform. CVE-2026-85056 is an authentication bypass vulnerability [CWE-287] in ZITADEL Login V2 that allows attackers to skip multi-factor authentication (MFA) under specific conditions. The flaw affects versions 4.0.0 through 4.16.0 and is fixed in version 4.16.1.

The Login V2 flow creates a browser session after password verification and can reuse that session for a later authentication request without re-verifying the user's enrolled TOTP, OTP, or U2F second factor. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected.

Critical Impact
An attacker who obtains valid primary credentials can complete an OIDC or SAML callback to a customer application without presenting a voluntarily enrolled second factor, defeating opt-in MFA protections.

Affected Products

ZITADEL versions 4.0.0 through 4.16.0 (Login V2)
OIDC relying parties integrated with affected ZITADEL instances
SAML service providers integrated with affected ZITADEL instances

Discovery Timeline

2026-09-24 - CVE CVE-2026-85056 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-85056

Vulnerability Analysis

The vulnerability resides in the Login V2 session validity logic. After a user completes primary password authentication, ZITADEL creates a browser session. When the user abandons the MFA step and starts login again, the session-validity check does not require a second-factor verification unless the organization has enabled Force MFA or Force MFA for local users only.

As a result, a user who voluntarily enrolled TOTP, OTP, or U2F can be authenticated to a downstream application without presenting that factor. The attacker reuses the browser session from the earlier abandoned login to complete the OIDC or SAML callback. This weakens the security guarantees of opt-in MFA across all customer applications federated to the identity provider.

Root Cause

The root cause is a missing MFA check in the session validity function used by Login V2. The patched code renames the function isSessionValid to isSessionValidForMfaSet and introduces isSessionPrimaryFactorAndLifetimeValid, distinguishing session states that have completed MFA from those that have only completed the primary factor. The original function treated a session with only password verification as valid for purposes it should not have been.

Attack Vector

The attack is network-based and requires no privileges or user interaction beyond initial password compromise. An attacker with valid credentials initiates a Login V2 flow, reaches the MFA prompt, abandons it, and then triggers a new authentication request from a relying party. The existing session satisfies the validity check and the OIDC or SAML callback completes without MFA verification.

text

// Patch excerpt: apps/login/src/app/(login)/mfa/set/page.tsx
   return { title: t("set.title") };
 }
 
-function isSessionValid(session: Partial<Session>): {
+function isSessionValidForMfaSet(session: Partial<Session>): {
   valid: boolean;
   verifiedAt?: Timestamp;
 } {

// Patch excerpt: apps/login/src/components/session-clear-item.tsx
 import { useRouter } from "next/navigation";
 import { useState } from "react";
 import { Avatar } from "./avatar";
-import { isSessionValid } from "./session-item";
+import { isSessionPrimaryFactorAndLifetimeValid } from "./session-item";
 import { Translated } from "./translated";

Source: Zitadel commit 049dbb2

Detection Methods for CVE-2026-85056

Indicators of Compromise

Successful OIDC or SAML callbacks for users with enrolled TOTP, OTP, or U2F factors where no MFA event is recorded in the authentication audit log.
Repeated Login V2 sessions where the MFA step is initiated and abandoned before a successful downstream application login.
Session reuse where the time between primary authentication and application callback spans multiple login attempts without an intervening MFA verification.

Detection Strategies

Query ZITADEL audit events for authentication records that show primary factor verification but lack a corresponding mfa.verified event prior to the OIDC or SAML callback.
Correlate browser session identifiers across multiple login attempts to detect reuse patterns consistent with abandoned MFA flows.
Baseline the ratio of MFA-verified logins per user with enrolled factors; investigate deviations that indicate MFA skipping.

Monitoring Recommendations

Forward ZITADEL authentication and session logs to a central SIEM for continuous correlation.
Alert on OIDC or SAML token issuance to users with enrolled second factors when no MFA assertion is present in the authentication context.
Monitor relying-party sign-in telemetry to identify applications receiving tokens without expected MFA claims.

How to Mitigate CVE-2026-85056

Immediate Actions Required

Upgrade ZITADEL to version 4.16.1 or later across all nodes serving Login V2.
Enable Force MFA at the organization level to require second-factor verification for all users, which prevents session reuse from bypassing MFA on unpatched instances.
Review authentication logs for the period preceding the upgrade and investigate successful logins to sensitive applications that lack MFA assertions.

Patch Information

ZITADEL fixed the vulnerability in release v4.16.1. The fix is implemented in commits 049dbb25a56587fb3980c85c99819cad69f637db and 56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43, which rework session validity checks to distinguish MFA-verified sessions from primary-factor-only sessions. See the GitHub Security Advisory GHSA-9993-rfwp-rhwf and the ZITADEL v4.16.1 release notes for full details.

Workarounds

Enable Force MFA or Force MFA for local users only on each organization until the upgrade is deployed; the validity check requires MFA when either policy is enabled.
Route sensitive OIDC and SAML relying parties through Login V1 until the Login V2 instance is patched.
Shorten session lifetimes for Login V2 to reduce the window in which an abandoned MFA session can be reused.

bash

# Upgrade ZITADEL to the patched release (container deployment example)
docker pull ghcr.io/zitadel/zitadel:v4.16.1
docker stop zitadel && docker rm zitadel
docker run -d --name zitadel \
  -p 8080:8080 \
  ghcr.io/zitadel/zitadel:v4.16.1 start-from-init

# Verify the running version
curl -s http://localhost:8080/debug/ready && \
  docker exec zitadel /app/zitadel --version