{"action":"Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260717062356-56f4798ed31f or later.","affected":[{"fixed":"1.80.0-v2.20.0.20260717062356-56f4798ed31f","introduced":"0"}],"component":"github.com/zitadel/zitadel","cve_ids":["CVE-2026-85056"],"ecosystem":"Go","epss":0.00285,"exploited":false,"fixed_versions":["1.80.0-v2.20.0.20260717062356-56f4798ed31f"],"ghsa_id":"GHSA-9993-rfwp-rhwf","id":"tcs_01M5KF586QP8WGH1CEJANVV93H","modified_at":"2026-10-01T20:56:14.075408631Z","published_at":"2026-09-24T18:19:35Z","references":["https://osv.dev/vulnerability/GHSA-9993-rfwp-rhwf","https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf","https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db","https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43","https://github.com/zitadel/zitadel","https://github.com/zitadel/zitadel/releases/tag/v4.16.1"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-9993-rfwp-rhwf","url":"https://osv.dev/vulnerability/GHSA-9993-rfwp-rhwf"}],"summary":"ZITADEL: MFA bypass via session reuse in Login V2"}