HIGH8.2
GO-2026-6589
ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel
Quick fix
GO-2026-6589 — github.com/zitadel/zitadel: upgrade to the fixed version with the command below.
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260717062356-56f4798ed31fDetails
ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/zitadel/zitadel
Introduced in:
0Fixed in: 1.80.0-v2.20.0.20260717062356-56f4798ed31fFix
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260717062356-56f4798ed31fReferences
- https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf[ADVISORY]
- https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db[FIX]
- https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43[FIX]
- https://github.com/zitadel/zitadel/releases/tag/v4.16.1[WEB]