CVE-2026-85056: zitadel Improper Authentication

Vulnerability summary

CVE-2026-85056 is a high (CVSS 8.2) Improper Authentication vulnerability in zitadel. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 19.9% of scored vulnerabilities.

Timeline

1. 24-09-2026
   PublishedVulnerability first disclosed.
2. 28-09-2026
   Last modifiedVulnerability information updated.

Description

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.