Executive brief
ZITADEL's Login V2, a cloud authentication service used by customer applications, allows an attacker with valid login credentials to bypass multi-factor authentication (MFA) by reusing an existing session from a previous login attempt. This means users who have enrolled optional second factors (like authenticator apps or security keys) can be impersonated without completing that additional verification step, compromising account security.
Technical details
The vulnerability is a session-reuse bypass in ZITADEL Login V2's MFA validation logic. The root cause is that Login V2 issues a session immediately after password verification, before MFA is completed. If a user abandons the MFA step and initiates login again, the system may reuse the existing password-verified session without re-checking enrolled second factors (TOTP, OTP, U2F). The flaw is conditional: it only affects scenarios where MFA is voluntarily enrolled but not organization-mandated via the "Force MFA" policy. An attacker who obtains valid credentials can authenticate without completing MFA, achieving full account compromise. The vulnerability affects Login V2 in ZITADEL versions 4.0.0 through 4.16.0 and is fixed in 4.16.1 and later. Login V1 and ZITADEL's own administrative interfaces are unaffected.
Affected products
- ZITADEL Login V2 4.0.0 through 4.16.0
Timeline
- 2026-09-24: disclosed: GHSA-9993-rfwp-rhwf published