PT-2026-113946 · Git+1 · Zulip
CVE-2026-102893
·
Published
2026-10-14
·
Updated
2026-10-14
CVSS v4.0
9.1
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Zulip Server versions prior to 12.2
Description
In the
GenericOpenIdConnectBackend component, the system matches the identity provider email claim to an active account's delivery email without rejecting an explicitly false email verified claim. This allows a user to be logged into an existing account if a misconfigured trusted identity provider returns an email address the user does not control with email verified=false.Recommendations
Update Zulip Server to version 12.2.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zulip