# CVE-2026-105211: ZITADEL authentication bypass in Login V2 OTP handling

Source: https://junglewise.ai/threats/cve-2026-105211-zitadel-before-4-17-1-contains-an-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-04. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105211 · Severity: high · CVSS 8.1 · Published 2026-10-04

ZITADEL is an identity and access management platform that handles user authentication and account management. An unauthenticated attacker who knows a user's login name can fully take over that account—including administrator accounts—by exploiting a flaw in the Login V2 interface that reveals one-time passwords for email and SMS second factors. The attacker gains unauthorized access without needing the user's password or any security keys.

Technologies: [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-105211 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105211 being exploited in the wild.

**How severe is CVE-2026-105211?** High severity, with a CVSS score of 8.1, published 4 October 2026.

**Which products and versions are affected?** ZITADEL 4.0.0 through 4.17.0.

**Is there a fix for CVE-2026-105211?** Yes: fixed in 4.17.1. Until then: Avoid enrolling both OTP-Email and OTP-SMS on the same account, especially for privileged users such as IAM_OWNER roles; prefer TOTP, U2F/security keys, or passkeys as second factors instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105211 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105211?** Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.17.1

Avoid enrolling both OTP-Email and OTP-SMS on the same account, especially for privileged users such as IAM_OWNER roles; prefer TOTP, U2F/security keys, or passkeys as second factors instead.

## Technical details

The vulnerability is an improper authentication bypass in Login V2's server actions, where the returnCode delivery type for OTP challenges exposes generated codes directly in HTTP responses instead of sending them out-of-band. An unauthenticated attacker can submit both OTP-Email and OTP-SMS codes obtained from these responses to create an MFA-authenticated session, since the backend incorrectly counted two second factors as satisfying MFA without requiring a primary authentication factor. The attack succeeds only against victims with both OTP factors enrolled and active; it was fixed in 4.17.1 by removing returnCode exposure in the frontend, enforcing primary authentication at the backend, and redefining MFA to require a primary plus secondary factor.

## Affected products

- ZITADEL ZITADEL 4.0.0 through 4.17.0

## Timeline

- 2026-08-14: disclosed
- 2026-10-04: advisory
- 2026-10-04: patched

## References

- [https://github.com/zitadel/zitadel/security/advisories/GHSA-3gwm-5wx8-4gm6](https://github.com/zitadel/zitadel/security/advisories/GHSA-3gwm-5wx8-4gm6)
- [https://www.vulncheck.com/advisories/zitadel-before-4.17.1-authentication-bypass-via-login-v2-otp-returncode](https://www.vulncheck.com/advisories/zitadel-before-4.17.1-authentication-bypass-via-login-v2-otp-returncode)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)