High severity8.1NVD Advisory· Published Oct 4, 2026· Updated Oct 4, 2026

CVE-2026-105211

Description

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.

Affected products

Zitadel/Zitadelllm-fuzzy
Range: <4.17.1

Patches

Vulnerability mechanics

References

github.com/zitadel/zitadel/security/advisories/GHSA-3gwm-5wx8-4gm6nvd
www.vulncheck.com/advisories/zitadel-before-4.17.1-authentication-bypass-via-login-v2-otp-returncodenvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000