CVE-2026-105211 in Zitadel
Summary
by MITRE • 10/04/2026
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in ZITADEL versions prior to 4.17.1 represents a critical authentication bypass flaw within the Login V2 component of the identity and access management platform. This security defect specifically targets the multi-factor authentication (MFA) workflow, allowing unauthenticated attackers to circumvent intended security controls by exploiting how one-time passcodes are delivered and processed during the login sequence. The core issue lies in the handling of the returnCode delivery type for OTP codes sent via email or SMS channels. In a properly secured system, these sensitive verification codes should be transmitted through secure, out-of-band mechanisms that do not expose them to potential interception within the application's primary request-response cycle. However, due to this implementation flaw, the server-action responses containing the actual OTP values are inadvertently exposed in a manner that allows an attacker with knowledge of the victim's login name to intercept and read these codes directly from the HTTP response data.
From a technical perspective, the vulnerability stems from improper separation of sensitive authentication data within the application logic. When a user initiates a login process requiring MFA verification via email or SMS using the returnCode method, the server generates the one-time password and sends it to the designated channel while simultaneously returning information in the HTTP response that includes the code itself. This behavior violates fundamental security principles regarding the protection of authentication credentials. An attacker who knows the username associated with an account enrolled for OTP-Email or OTP-SMS can trigger this login flow repeatedly, capturing the server responses each time. By parsing these responses, the attacker retrieves the valid one-time passcodes without needing access to the victim's email inbox or mobile device. This effectively neutralizes the second factor of authentication, reducing the security posture to that of a single-factor system where only knowledge of the username is required for further exploitation steps.
The operational impact of this vulnerability is severe, particularly given ZITADEL's role as an identity provider managing access for numerous applications and services. Successful exploitation allows attackers to gain full MFA-authenticated sessions on behalf of any targeted user whose login name is known. This includes the potential takeover of administrative accounts, which could lead to comprehensive compromise of the organization's identity infrastructure. Once an attacker achieves authenticated status through this bypass, they can access all resources protected by ZITADEL for that user profile. For high-privilege accounts such as system administrators or security operators, this results in a complete breach of confidentiality and integrity across the entire ecosystem dependent on the compromised identity provider. The ability to impersonate legitimate users also facilitates lateral movement within networks, data exfiltration, and potential persistence mechanisms if the attacker modifies account settings or creates new backdoor credentials.
This vulnerability aligns with several established industry standards for classifying security weaknesses. It is primarily categorized under CWE-287, which denotes Improper Authentication, as the system fails to adequately verify the identity of users during the authentication process. Furthermore, it relates closely to CWE-359, specifically regarding exposure of sensitive information in server responses when such data should remain confidential until securely delivered through designated channels. In terms of offensive security frameworks like MITRE ATT&CK, this flaw enables techniques associated with Credential Access and Account Manipulation. Specifically, the ability to intercept authentication factors maps to T1078 Valid Accounts, where attackers use legitimate credentials obtained through various means to gain initial access. The exploitation method also reflects aspects of T1621 Multi-Factor Authentication Interception, although in this case, it is achieved via server-side response leakage rather than traditional phishing or SIM swapping techniques.
To mitigate this vulnerability and protect identity infrastructure integrity, organizations running ZITADEL must immediately upgrade to version 4.17.1 or later where the issue has been resolved by correcting the handling of OTP delivery mechanisms. Until an upgrade is feasible, administrators should consider disabling the returnCode delivery type for email and SMS if it remains enabled in their configuration settings. Implementing additional monitoring for unusual login patterns involving multiple failed attempts followed by successful MFA verification can help detect potential exploitation activities. Security teams should also enforce strict access controls on administrative accounts and ensure that all critical systems relying on ZITADEL are patched to prevent cascading failures resulting from identity compromise. Regular audits of authentication logs and review of server response headers for sensitive data leakage patterns are recommended practices to maintain robust security posture in the face of evolving threats targeting identity management platforms.