Authentication Bypass Vulnerability in ZITADEL by ZITADEL
CVE-2026-105211

9.2CRITICAL

Key Information:

Vendor

Zitadel

Status
Zitadel
Vendor
CVE Published:
4 October 2026

What is CVE-2026-105211?

ZITADEL versions before 4.17.1 are vulnerable to an authentication bypass affecting the Login V2 feature. This issue allows attackers to exploit the OTP returnCode delivery method, enabling them to obtain one-time passwords sent to users via email or SMS. By knowing the login name of a targeted user, attackers can gain access to MFA-authenticated sessions, potentially resulting in unauthorized account takeovers, including administrator accounts. Proper security measures and updates should be implemented to mitigate this vulnerability.

Affected Version(s)

zitadel 0 < 4.17.1

zitadel 4.17.1

References

https://github.com/zitadel/zitadel/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/zitadel-before-4.17....
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

IAM-marco
livio-a
lucasdodgson
.