CVE-2026-85056

Katalog CVE

CVSS 8.2 · High EPSS 0,29%

Kerentanan Improper Authentication. Skor CVSS 3.1 8.2 (High) menurut github.com.

Deskripsi (NVD)

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

Rincian

Terbit di NVD

24 September 2026

Terakhir diubah

28 September 2026

Status NVD

Deferred

CVSS 3.1

8.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db
• https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43
• https://github.com/zitadel/zitadel/releases/tag/v4.16.1
• https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf