Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-102893: Zulip can log in with unverified email address
CVE-2026-102893 · published 2 days ago
Summary
In Zulip Server versions up to 12.1, the login process does not check whether the identity provider says the email address is verified. If a trusted provider returns an email the user doesn't own and marks it as unverified, Zulip may still sign the user into an existing account that uses that email. Upgrade to version 12.2 or later to ensure only verified emails are accepted, or configure your identity provider to only issue verified email addresses.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zulip | zulip | < 12.2 |
Original advisory text
Zulip: OpenID Connect authentication ignores the email_verified claim
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.
References
- https://github.com/zulip/zulip/security/advisories/GHSA-xw9h-9rcm-hx4m
- https://github.com/zulip/zulip/pull/39913
- https://github.com/zulip/zulip/commit/68d2d9defa39f8af96a50fc7430efc34dee120b5
- https://github.com/zulip/zulip/commit/b40f191a8c71e74fcb471f71de6a1233de157102
- https://github.com/zulip/zulip/releases/tag/12.2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1028... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102893 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-287Improper Authentication
Timeline
Published14 Oct 2026
Updated16 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-102893 · NVD
CVE-2026-102893 · MITRE
CVE-2026-102893 · OSV
GHSA-xw9h-9rcm-hx4m · GHSA
Track software like this
Free during beta