Zitadel Before 4.17.1 Authentication Bypass Via Login V2 For Deactivated Organizations

Back www.vulncheck.com

Zitadel Before 4.17.1 Authentication Bypass Via Login V2 For Deactivated Organizations

www.vulncheck.com • October 4, 2026

Share: View original

ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations

zitadel >= 0, = 0, < 4.17.1

CWE-287 Improper Authentication

GitHub Security Advisory (GHSA-558c-v5wc-9w4q)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Zitadel Vulnerabilities: Authentication Bypass and MFA Issues Multiple vulnerabilities have been identified in Zitadel versions prior to 4.17.1, including authentication bypass via Login V2 for deactivated organizations and unauthenticated MFA enrollment via Login V1 init handlers. These vulnerabilities, which include CVE-2026-558c-v5wc-9w4q, allow unauthorized access and potential account takeover. The affected versions are Zitadel 0.0.0 to 4.17.0. The vulnerabilities are significant as they could lead to unauthorized actions within the system. No has been reported as of now, but the vulnerabilities are concerning enough to warrant immediate attention from users. Patches are expected to be released soon, and organizations are advised to monitor for updates. 43

Extracted Entities

Companies (1)

CWE Weaknesses (1)

CWE-287 - Improper Authentication