Servers and applications
GHSA-9vfg-mj6p-vwjc
Login V2: opening a link adds an OTP email or SMS second factor to a signed-in user without confirmation
- Severity
- Medium 4.3
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Added to UpHeron
- 13 Nov 2026
- Fixed in
- 4.20.3
- Attack
- Over the network · No login needed · Needs someone to click or open something
- Attacker can
- Change some data
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N- Sources
- Project advisories (GitHub)
Description
ZITADEL’s hosted Login V2 UI let an attacker add a second factor to the account of a signed‑in user by getting them to open a link. A user with an authenticated Login V2 session who opened the setup page for one of these factors — for example through a link or redirect from another site — had OTP‑Email or OTP‑SMS added to their account, without any confirmation.
The page added the factor while it was being loaded, instead of in response to an explicit action of the user, so it could not tell a deliberate enrolment from one triggered by another site.
An attacker who can get a signed‑in user to open a link can:
- Add OTP‑Email as a second factor to the user’s account, if the user has a verified email address.
- Add OTP‑SMS as a second factor to the user’s account, if the user has a verified phone number.
This affects deployments that serve ZITADEL’s hosted Login V2 UI.
Workarounds
The recommended solution is to upgrade to a patched version. There is no configuration that fully closes this gap on unpatched versions. Removing OTP‑Email and OTP‑SMS from the second factors allowed in the login settings only limits which factors users are offered; it does not prevent the page from adding them.
Affected software
| Software | Affected versions |
|---|---|
ZITADELServers and applications · github:zitadel/zitadel |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-9vfg-mj6p-vwjc
- github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-9vfg-mj6p-vwjc