CVE-2026-56666

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 4.15.3

Description The external identity provider handler fails to verify that the external identity provider confirmed ownership of an email address before performing auto-linking by email. While the system checks if the local user's email is verified, the lack of external confirmation allows a permissive provider account using a victim's email address to be linked to the victim's local account.

Recommendations Update to version 4.15.3.