Is CVE-2026-85056 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85056 being exploited in the wild.

How severe is CVE-2026-85056?

High severity, with a CVSS score of 8.2, published 24 September 2026.

Which products and versions are affected?

github.com/zitadel/zitadel (Go) < 1.80.0-v2.20.0.20260717062356-56f4798ed31f, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20260717062356-56f4798ed31f; ZITADEL Login V2 4.0.0 through 4.16.0.

Is there a fix for CVE-2026-85056?

Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260717062356-56f4798ed31f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85056 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-85056?

Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL Login V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85056: ZITADEL Login V2 MFA bypass via session reuse

Q: Is there a fix for CVE-2026-85056?

Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260717062356-56f4798ed31f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-85056 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-85056?

Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL Login V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85056 · Severity: high · CVSS 8.2 · Published 2026-09-24

ZITADEL's Login V2, a cloud authentication service used by customer applications, allows an attacker with valid login credentials to bypass multi-factor authentication (MFA) by reusing an existing session from a previous login attempt. This means users who have enrolled optional second factors (like authenticator apps or security keys) can be impersonated without completing that additional verification step, compromising account security.

Technologies: github.com/zitadel/zitadel (Go). Vendors: Go, ZITADEL.

Quick answers

Is CVE-2026-85056 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85056 being exploited in the wild.
How severe is CVE-2026-85056?: High severity, with a CVSS score of 8.2, published 24 September 2026.
Which products and versions are affected?: github.com/zitadel/zitadel (Go) < 1.80.0-v2.20.0.20260717062356-56f4798ed31f, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20260717062356-56f4798ed31f; ZITADEL Login V2 4.0.0 through 4.16.0.
Is there a fix for CVE-2026-85056?: Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260717062356-56f4798ed31f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85056 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-85056?: Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL Login V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260717062356-56f4798ed31f or later
```
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260717062356-56f4798ed31f
```

Technical details

The vulnerability is a session-reuse bypass in ZITADEL Login V2's MFA validation logic. The root cause is that Login V2 issues a session immediately after password verification, before MFA is completed. If a user abandons the MFA step and initiates login again, the system may reuse the existing password-verified session without re-checking enrolled second factors (TOTP, OTP, U2F). The flaw is conditional: it only affects scenarios where MFA is voluntarily enrolled but not organization-mandated via the "Force MFA" policy. An attacker who obtains valid credentials can authenticate without completing MFA, achieving full account compromise. The vulnerability affects Login V2 in ZITADEL versions 4.0.0 through 4.16.0 and is fixed in 4.16.1 and later. Login V1 and ZITADEL's own administrative interfaces are unaffected.

Affected products

ZITADEL Login V2 4.0.0 through 4.16.0

Identifiers

CVE-2026-85056
GHSA-9993-rfwp-rhwf
GO-2026-6589

Timeline

2026-09-24: disclosed: GHSA-9993-rfwp-rhwf published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.