---
id: CVE-2026-85056
title: ZITADEL is an open source identity management platform
summary: >-
  ZITADEL is an open source identity management platform. From 4.0.0 until
  4.16.1, ZITADEL Login V2 creates a browser session after password verification
  and can reuse that session for a later authentication request without
  verifying a use…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-287
vendor: zitadel
product: github.com/zitadel/zitadel
affected:
  - github.com/zitadel/zitadel < 1.80.0-v2.20.0.20260717062356-56f4798ed31f
patched:
  - github.com/zitadel/zitadel 1.80.0-v2.20.0.20260717062356-56f4798ed31f
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T18:19:04.180'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85056'
references:
  - url: >-
      https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db
    label: security-advisories@github.com
  - url: >-
      https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43
    label: security-advisories@github.com
  - url: 'https://github.com/zitadel/zitadel/releases/tag/v4.16.1'
    label: security-advisories@github.com
  - url: 'https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-9993-rfwp-rhwf'
  - url: 'https://github.com/zitadel/zitadel'
tags:
  - nvd
  - ghsa
  - go
  - cve.org
  - osv
aliases:
  - GHSA-9993-rfwp-rhwf
ecosystem: go
ingestedAt: '2026-09-24T17:48:30.404Z'
epss: 0.00285
epssPercentile: 0.18777
---

## Overview

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-85056)

Affected packages:

- `github.com/zitadel/zitadel < 1.80.0-v2.20.0.20260717062356-56f4798ed31f`

Patched in:

- `github.com/zitadel/zitadel 1.80.0-v2.20.0.20260717062356-56f4798ed31f`

Source: https://github.com/advisories/GHSA-9993-rfwp-rhwf