ZITADEL EUVD-2026-86324

Requires ZITADEL 4.0.0-4.16.0 using Login V2 (Login V1 is not affected). The targeted user must have VOLUNTARILY enrolled a second factor (TOTP, OTP, or U2F), and the organization must have Force MFA and 'Force MFA for local users only' both DISABLED - with either policy enabled the session-validity check still requires MFA and the bypass fails. The attacker must possess the victim's valid first-factor password to complete the initial password verification, then abandon the MFA step and restart the flow to reuse the session while completing an OIDC or SAML callback to a customer application. Not exploitable against the ZITADEL Console, Management/Admin APIs, or user self-management.

The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) frames this as a high-severity, network-reachable authentication-bypass flaw, and CWE-287 plus the 'Authentication Bypass' tag are consistent with a genuine MFA-verification gap in ZITADEL Login V2. However, the raw score overstates unconditional risk: exploitation is not a blind remote attack. Two real limiting factors are established by the description - the victim must have VOLUNTARILY enrolled a second factor (TOTP/OTP/U2F), and the organization must NOT enforce 'Force MFA' or 'Force MFA for local users only'; where Force MFA is enabled, the session-validity check still demands MFA and the bypass does not apply. The vector's PR:N is debatable because a practical attack requires the attacker to already possess the victim's valid first-factor password, which is a meaningful precondition (see assessed vector, where I use PR:L). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this is 'no public exploit identified at time of analysis' rather than active exploitation - SSVC-style signals point toward a patch-promptly (not act-now) priority. The confidentiality impact is real (an attacker with a stolen password can complete an OIDC/SAML login to downstream customer applications as the victim, defeating the user's opt-in MFA), so for organizations running affected versions with users who self-enrolled MFA but without Force MFA policy, this is a legitimate priority to patch, not a purely theoretical high-CVSS item.

An attacker who has phished or otherwise obtained a victim's ZITADEL password logs in via Login V2, passes password verification (which creates a browser session), then abandons the MFA prompt and restarts login; because the organization has not enabled Force MFA, the reused session passes validity checks without the victim's enrolled TOTP/U2F factor, and the attacker completes an OIDC or SAML callback to a customer application as the victim. No public exploit code is identified at time of analysis, but the flow is straightforward and requires no special tooling once the password is known.