What’s Vulnerable › Vulnerabilities

CVE-2026-105211: ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-04 · updated 2026-10-05
• Weakness: CWE-200

Description

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.

Affected products

• zitadel: before 4.17.1 — fixed in 4.17.1

How to fix

Upgrade to a fixed version: zitadel 4.17.1. Check the vendor advisory for mitigations.

References

• https://github.com/zitadel/zitadel/security/advisories/GHSA-3gwm-5wx8-4gm6
• https://www.vulncheck.com/advisories/zitadel-before-4.17.1-authentication-bypass-via-login-v2-otp-returncode

Get alerted when CVE-2026-105211 or the next vulnerability affects your stack