CVE-2026-102893
CriticalCVSS 9.1Summary
Zulip Server through 12.1 has a vulnerability in GenericOpenIdConnectBackend that does not reject an explicitly false email_verified claim, allowing login to an existing account if a misconfigured trusted identity provider returns an email address not controlled by the user.
Risk Assessment
An attacker may take over a user account if the identity provider is misconfigured, leading to unauthorized access to data.
Recommendation
Upgrade Zulip Server to version 12.2 or later and review identity provider configuration to ensure it only returns email addresses controlled by the authenticating user.
Other vulnerabilities in Zulip Server
See all- CVE-2017-0910High
In Zulip Server before 1.7.1, a vulnerability in the invitation system allows an authorized user from one realm on the server to create a user account in any other realm.
- CVE-2023-33186High
Zulip, a team collaboration tool, has a cross-site scripting (XSS) vulnerability in tooltips on the message feed. An attacker can craft a malicious topic for a message that, when hovered over by a victim, executes JavaScript code controlled by the attacker.
Original NVD description (English source)
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS