ZITADEL: Authentication bypass via OTP return codes in Login V2
Summary
ZITADEL's hosted Login V2 UI can be abused by an unauthenticated attacker who knows only a victim's login name. If the victim has both OTP-Email and OTP-SMS enrolled, the attacker can read both one-time codes from server-action responses and obtain a fully MFA-authenticated session. This can lead to full instance takeover if the victim is an instance administrator.
Affected
- ZITADEL 4.0.0 through 4.17.0 (including RC versions)
- ZITADEL versions before 4.17.1 according to the CVE record
- Version 3.x: Unknown. Check the GHSA affected-range table.
Fixed in
- Fixed in ZITADEL 4.17.1
- Later 4.x releases also contain the fix; a later separate issue (CVE-2026-119127) affects 4.0.0 before 4.19.5
Workaround
- No configuration fully closes the gap on unpatched versions.
- Avoid having both OTP-Email and OTP-SMS enrolled on the same account, especially for IAM_OWNER users.
- Prefer TOTP, U2F/security keys or passkeys as second factors.
Exploitation
- No known exploitation according to available sources; not listed in CISA KEV.
- No public proof-of-concept exploit confirmed.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Identify all ZITADEL instances and their versions, and check whether the login endpoint is internet-facing.
- Upgrade to the latest 4.x release, at least 4.17.1.
- Audit accounts, especially administrators, for enrolled OTP-Email and OTP-SMS factors and replace them with stronger factors.
- Review login and admin-session logs for unexpected OTP or MFA events.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3gwm-5wx8-4gm6 github.com
- VulnCheck advisory: ZITADEL before 4.17.1 Authentication Bypass www.vulncheck.com
- ZITADEL release v4.17.1 github.com
- OSV entry CVE-2026-105211 osv.dev
- Red Packet Security CVE alert CVE-2026-105211 www.redpacketsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:54.
Original description (NVD)
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.