ZITADEL Login V2 OTP codes exposed via returnCode type

ZITADEL Login V2 allowed unauthenticated attackers to obtain OTP codes via the returnCode delivery type, enabling account takeover. Affects 4.x before 4.17.1.

cat cve-2026-105211.json

Vendor: ZITADEL
Product: ZITADEL (4.x before 4.17.1; fixed in 4.17.1)
CVSS: 8.1
EPSS (exploit probability): 0.3%
Status: patched
Published: October 4, 2026
Source: https://github.com/zitadel/zitadel/security/advisories/GHSA-3gwm-5wx8-4gm6

ZITADEL’s Login V2 UI contained an authentication bypass: the returnCode delivery type exposed OTP codes to unauthenticated callers, allowing account takeover without knowing the target user’s credentials.

Affected: ZITADEL 4.x before 4.17.1.

Fixed in: 4.17.1.

Source: GHSA-3gwm-5wx8-4gm6.

Related coverage

~/articles/2026-10-05-zitadel-four-auth-bypass-cves

● Breaking

threat intel

ZITADEL Patches Four Auth Bypass Flaws, Two Critical

ZITADEL patched four authentication bypass CVEs this week, including CVE-2026-105207 at CVSS 9.8 and CVE-2026-105215 at CVSS 9.1. None confirmed exploited in the wild.

Oct 5read →