CVE-2026-105211

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 4.17.1

Description An authentication bypass exists in Login V2 that allows unauthenticated attackers to take over accounts. Attackers who know the login name of a victim enrolled in OTP-Email and OTP-SMS can obtain One-Time Password (OTP) codes through the returnCode delivery type by reading them from server-action responses. This allows the attacker to establish MFA-authenticated sessions, which may include the takeover of administrator accounts.

Recommendations Update ZITADEL to version 4.17.1 or later.