TI-2025-22659 Aliases CVE-2025-31478

Zulip Authentication Backend Configuration Bypass

MEDIUM 42CWE-287Published 2025-04-16 · Updated 2026-01-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a single-sign on authentication backend, meaning the organization places no restrictions on email address domains or invitations being required to join, but has disabled the EmailAuthBackend that is used for email/password authentication. A bug in the Zulip server means that it is possible to create an account in such organizations, without having an account with the configured SSO authentication backend. This issue is patched in version 10.2. A workaround includes requiring invitations to join the organization prevents the vulnerability from being accessed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00361 30th percentileScored 2026-11-07

Fix Fixed zulip (zulip): 10.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zulip	zulip	before 10.2	10.2	Patch available	CNA

zulip Vendorzulip Affected before 10.2 Fixed in 10.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zulip:zulip_server::::::::	before 10.2	Vulnerable	zulip

cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:* Versions before 10.2 Vulnerable ·zulip

Remediation

Fix · CNA zulip (zulip) Fixed in 10.2

Timeline

2026-10-02 Threatist record created from CVE-2025-31478

References

Advisory 1

https://github.com/zulip/zulip/security/advisories/GHSA-qxfv-j6vg-5rqc

Other 1

https://github.com/zulip/zulip/commit/b5ab90aaa4a7efdcbf886cb9e7d55fa5bfca3a28

TI-2024-37129 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server CVSS 4.0MEDIUM 6.9
TI-2022-06082 Multi-use invitations can grant access to other organizations in Zulip CVSS 3.1CRITICAL 9.8
TI-2019-13649 In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process… CVSS 3.1CRITICAL 9.8
TI-2024-24345 Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. CVSS 3.1HIGH 7.5
TI-2020-11848 Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to… CVSS 3.1HIGH 8.8
TI-2017-00857 Incorrect authorization in Zulip Server CVSS 3.0HIGH 8.8

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences