# CVE-2026-85056: ZITADEL Login V2 MFA bypass via session reuse

Source: https://junglewise.ai/threats/cve-2026-85056-zitadel-login-v2-mfa-bypass-via-session-reuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85056 · Severity: high · CVSS 8.2 · Published 2026-09-24

ZITADEL's Login V2, a cloud authentication service used by customer applications, allows an attacker with valid login credentials to bypass multi-factor authentication (MFA) by reusing an existing session from a previous login attempt. This means users who have enrolled optional second factors (like authenticator apps or security keys) can be impersonated without completing that additional verification step, compromising account security.

Technologies: [github.com/zitadel/zitadel (Go)](https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-85056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85056 being exploited in the wild.

**How severe is CVE-2026-85056?** High severity, with a CVSS score of 8.2, published 24 September 2026.

**Which products and versions are affected?** github.com/zitadel/zitadel (Go) < 1.80.0-v2.20.0.20260717062356-56f4798ed31f, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20260717062356-56f4798ed31f; ZITADEL Login V2 4.0.0 through 4.16.0.

**Is there a fix for CVE-2026-85056?** Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260717062356-56f4798ed31f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85056 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-85056?** Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL Login V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260717062356-56f4798ed31f or later

  ```sh
  go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260717062356-56f4798ed31f
  ```


## Technical details

The vulnerability is a session-reuse bypass in ZITADEL Login V2's MFA validation logic. The root cause is that Login V2 issues a session immediately after password verification, before MFA is completed. If a user abandons the MFA step and initiates login again, the system may reuse the existing password-verified session without re-checking enrolled second factors (TOTP, OTP, U2F). The flaw is conditional: it only affects scenarios where MFA is voluntarily enrolled but not organization-mandated via the "Force MFA" policy. An attacker who obtains valid credentials can authenticate without completing MFA, achieving full account compromise. The vulnerability affects Login V2 in ZITADEL versions 4.0.0 through 4.16.0 and is fixed in 4.16.1 and later. Login V1 and ZITADEL's own administrative interfaces are unaffected.

## Affected products

- ZITADEL Login V2 4.0.0 through 4.16.0

## Identifiers

- CVE-2026-85056
- GHSA-9993-rfwp-rhwf
- GO-2026-6589

## Timeline

- 2026-09-24: disclosed: GHSA-9993-rfwp-rhwf published

## Related threats

- [ZITADEL Actions V1 sandbox escape via require() filesystem read](https://junglewise.ai/threats/cve-2026-85057-zitadel-actions-v1-sandbox-escape-via-require-filesystem-read)
- [ZITADEL improper role revocation on granted projects](https://junglewise.ai/threats/cve-2026-76081-zitadel-improper-role-revocation-on-granted-projects)
- [ZITADEL incorrect authorization in email and phone self-management API](https://junglewise.ai/threats/cve-2026-54693-zitadel-incorrect-authorization-in-email-and-phone-self)
- [ZITADEL privilege escalation in OAuth2 Token Exchange](https://junglewise.ai/threats/cve-2026-56668-zitadel-privilege-escalation-in-oauth2-token-exchange)
- [ZITADEL improper authentication in external identity provider auto-linking](https://junglewise.ai/threats/cve-2026-56666-zitadel-improper-authentication-in-external-identity-provider)