CVE-2026-102893
Severity not reportedZulip is an open-source team collaboration tool.
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/zulip/zulip/commit/68d2d9defa39f8af96a50fc7430efc34dee120b5 security-advisories@github.com
- https://github.com/zulip/zulip/commit/b40f191a8c71e74fcb471f71de6a1233de157102 security-advisories@github.com
- https://github.com/zulip/zulip/pull/39913 security-advisories@github.com
- https://github.com/zulip/zulip/releases/tag/12.2 security-advisories@github.com
- https://github.com/zulip/zulip/security/advisories/GHSA-xw9h-9rcm-hx4m security-advisories@github.com