Read the docs
TI-2026-74170 Aliases CVE-2026-102893

Zulip OpenID Connect login ignores unverified email addresses

Priority MEDIUM 47CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Zulip Server versions before 12.2 are affected. GenericOpenIdConnectBackend matches the identity provider email claim to an active account without rejecting an explicitly false email_verified claim, an improper authentication flaw (CWE-287). If a configured identity provider returns an email address the user does not control together with email_verified=false, a remote attacker can log into the existing account for that address, but only when the identity provider is misconfigured and trusted.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Fixed zulip (zulip): 12.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zulipzulipbefore 12.212.2Patch availableCNA
  • zulip Vendorzulip Affected before 12.2 Fixed in 12.2 Patch available CNA

Remediation

Upgrade Zulip Server to version 12.2, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA zulip (zulip) Fixed in 12.2

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-102893
  2. 2026-10-16 CISA SSVC decision points changed

References

Other 5

  • TI-2024-37129 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server CVSS 4.0MEDIUM 6.9
  • TI-2026-20810 Zulip: Anonymous File Access After Disabling Spectator Access CVSS 3.1MEDIUM 5.3
  • TI-2026-21062 Zulip: Path Traversal in Import CVSS 3.1MEDIUM 6.1
  • TI-2021-19605 RabbitMQ exposes ports with weak default secrets in Zulip Server CVSS 3.1CRITICAL 9.8
  • TI-2022-06082 Multi-use invitations can grant access to other organizations in Zulip CVSS 3.1CRITICAL 9.8
  • TI-2023-15953 Users who can send invitations can erroneously add users to streams during invitation in Zulip CVSS 3.1LOW 3.1
See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences