Vulnerability · Published Oct 4, 2026 · Assigned by VulnCheck

CVE-2026-105211ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

High 8.1

In plain English

A high-severity information exposure in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 73.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.

Affected products (as reported)

Vendor	Product	Versions
zitadel	zitadel	0 – before 4.17.1

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-3gwm-5wx8-4gm6) vendor-advisory
VulnCheck Advisory: ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode third-party-advisory