CVE-2026-105211 - ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
Brief
CVE ID : CVE-2026-105211
Published : Oct. 4, 2026, 3:16 p. m.
- 4 hours, 15 minutes ago
Description : ZITADEL before 4.
- 1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.
Severity: 9.2
- CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...