Advisory · CVE-2026-105211
ZITADEL leaks OTP codes in Login V2 responses
ZITADEL Login V2 exposes one-time passcodes through the returnCode delivery type, letting unauthenticated attackers read OTP-Email and OTP-SMS codes from server responses and take over accounts, including admin accounts.
- Vendor
- ZITADEL
- Product
- ZITADEL
- Identifier / CWE
- CVE-2026-105211
CWE-200 - Action timing
- Immediate
Explain it like I’m five
ZITADEL is supposed to send the one-time code to your email or phone, but with one setting it also hands the code back to whoever asked for the login page. An attacker asks for a login for your account, reads your code out of the reply, types it in, and is logged in as you, even past your second factor.
- 01Attacker targets login name
The unauthenticated attacker initiates a Login V2 flow for a victim who has OTP-Email or OTP-SMS enrolled.
- 02Codes returned in response
With the returnCode delivery type, the server-action responses contain both OTP codes.
- 03Codes replayed
The attacker submits the codes, satisfying the MFA step.
- 04MFA-authenticated session
The attacker gains an MFA-authenticated session as the victim, including administrator accounts.
What happened
ZITADEL before 4.17.1 contains an authentication bypass in Login V2: the returnCode delivery type exposes OTP codes in server-action responses. Unauthenticated attackers who know a victim’s login name, where the victim has OTP-Email and OTP-SMS enrolled, can read both codes and obtain MFA-authenticated sessions, including administrator takeover. It is rated critical at CVSS 9.2 under CVSS v4.0 (8.1 under v3.1) and tracked as CWE-200.
What to do
- Upgrade ZITADEL to 4.17.1 or later.
- Review authentication logs for sessions established through the returnCode delivery type, with attention to administrator accounts.
- Treat any session obtained this way as compromised: terminate sessions, rotate credentials, and re-verify enrolled factors.
- Confirm the returnCode delivery path no longer exposes codes after the upgrade.
Management note
A second factor that the server hands to the attacker is not a second factor at all. This is unauthenticated administrator takeover with nothing more than a username, which makes it one of the most severe shapes in this batch. The fix is a version bump, but the incident response question is whether any privileged sessions were minted this way before patching.