Summary
ZITADEL Login V2 may reuse a browser session after password verification without requiring a voluntarily enrolled TOTP, OTP, or U2F factor. An attacker who can cause an MFA attempt to be abandoned and then restart authentication could complete an OIDC or SAML callback without the expected second factor.
Affected context
The issue affects ZITADEL Login V2 deployments in the affected release range when users have enrolled a second factor but the organization does not require MFA through a force-MFA policy. A browser session created after password verification may remain usable for a later authentication request, allowing an OIDC or SAML login flow to proceed without rechecking the user's TOTP, OTP, or U2F factor. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are outside the described impact.
Exploit preconditions
- Attack surface: ZITADEL Login V2 browser authentication flows
- Required access: Credentials for a user with an enrolled MFA factor, plus the ability to interact with that user's authentication session
- Trigger point: Restarting authentication after an MFA step is abandoned, followed by completion of an OIDC or SAML callback
- Policy condition: MFA is enrolled voluntarily and the organization does not enforce a policy requiring MFA for the affected user
- Why exploitation is possible: Session-validity checks may treat the post-password browser session as sufficient without confirming completion of the enrolled second factor
Why this happens
The underlying bug is an authentication-state validation failure. Login V2 creates a browser session after password verification and can reuse that session without preserving or enforcing the requirement that an enrolled second factor must be completed. This maps to CWE-287: Improper Authentication, because the application accepts an authentication state that does not satisfy the user's configured authentication requirements.
Potential impact
- An attacker may bypass a user's enrolled MFA factor
- An attacker could access customer applications through OIDC or SAML callbacks
- Protected account data and application functions may be exposed
- The affected account's security assurance could be reduced from multi-factor to password-only authentication
General mitigation guidance
Mitigation generally focuses on binding session validity to the complete authentication policy rather than to password verification alone.
Common defensive patterns include:
- Require an enrolled second factor to be completed before issuing or reusing an application-usable session
- Reevaluate MFA requirements whenever an authentication flow is restarted
- Bind callback authorization to the authentication context and assurance level actually achieved
- Prefer secure-by-default MFA enforcement for sensitive applications and accounts
- Reduce trust in stale browser sessions by applying bounded lifetimes and clear invalidation rules
- Apply least privilege to identities and customer applications so an authentication-policy failure limits exposure
- Monitor vendor security advisories and maintain deployments on supported releases containing the relevant correction
How teams detect issues like this
Organizations can look for this class of issue through:
- Static and dynamic tests that compare enrolled MFA requirements with the assurance level recorded in an authentication session
- Code review signals involving session creation immediately after password verification, session reuse across login restarts, and callback authorization
- Tests covering abandoned MFA challenges, repeated authentication attempts, and OIDC or SAML callback completion
- Policy enforcement requiring MFA assurance for sensitive relying parties and high-risk accounts
- Authentication logs that show successful callbacks without a corresponding completed TOTP, OTP, or U2F event
- Automated security review tools that flag authentication-state transitions and missing step-up verification
