From Zitadel version 4.0.0 through 4.16.1 the Login V2 flow creates a browser session after a user’s password has been verified and that session may later be reused for another authentication request without re‑checking any of the user’s enrolled TOTP, OTP, or U2F factors. If the user abandons the MFA step and then completes an OIDC or SAML callback, the session‑validity checks only enforce MFA when the organization has enabled “Force MFA” or “Force MFA for local users.” In a typical configuration the voluntary MFA enrollment can therefore be skipped while completing the callback, allowing the attacker to authenticate without passing MFA. This weakens the authentication chain (CWE‑287) and potentially permits privileged access to protected applications.

The affected product is Zitadel (open‑source identity‑management platform) and all releases from 4.0.0 up to and including 4.16.1. Only the Login V2 flow is affected; the Login V1 flow, console, management APIs, and self‑management interfaces are not vulnerable.

The vulnerability carries a CVSS score of 8.2, indicating a high‑severity impact. EPSS is not available and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be a remote web‑based attack, requiring an attacker to initiate a login flow, bypass the MFA prompt, and complete a callback. No exploit code is publicly disclosed, but the flaw could be exploited by automated scripts targeting applications that rely on Zitadel’s OIDC or SAML integration.