www.vulncheck.com Zitadel Vulnerabilities: Authentication Bypass and MFA Issues
Article Content
- •Zitadel versions before 4.17.1 are vulnerable to multiple authentication bypass issues.
- •Exploits could allow unauthorized access and MFA enrollment without proper authentication.
- •No confirmed active exploitation has been reported yet, but vigilance is advised.
Multiple vulnerabilities have been identified in Zitadel versions prior to 4.17.1, including authentication bypass via Login V2 for deactivated organizations and unauthenticated MFA enrollment via Login V1 init handlers. These vulnerabilities, which include CVE-2026-558c-v5wc-9w4q, allow unauthorized access and potential account takeover. The affected versions are Zitadel 0.0.0 to 4.17.0. The vulnerabilities are significant as they could lead to unauthorized actions within the system. No has been reported as of now, but the vulnerabilities are concerning enough to warrant immediate attention from users. Patches are expected to be released soon, and organizations are advised to monitor for updates.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track Zitadel in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of Zitadel are affected?
Is there any active exploitation of these vulnerabilities?
What should organizations do to protect themselves?
Continue Reading
Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises… 
Critical Authentication Bypass in Cisco Catalyst SD-WAN Manager Exploited On September 30, 2026, Cisco disclosed a critical vulnerability (CVE-2026-76504) in the Catalyst SD-WAN Manager that allows unauthenticated remote attackers to bypass authentication and gain admin-level access to the system. This flaw stems from improper handling of URI encoding in HTTP requests, enabling attackers to…