CVE-2026-105211
ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
- State
- Published
- Severity
- 9.2 Critical
- Published
- Oct 4, 2026
- Updated
- Oct 5, 2026
- Reserved
- Oct 4, 2026
Description
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
zitadelzitadel |
|
References
- GitHub Security Advisory (GHSA-3gwm-5wx8-4gm6)vendor-advisory
- VulnCheck Advisory: ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCodethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.