CVE-2026-102893
9.1CriticalPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-287
Impact
Remote attackers can hijack existing user accounts without credentials if your OpenID Connect identity provider emits unverified email addresses. To exploit this, the attacker needs to authenticate through a configured IdP that returns an unverified email address matching a target Zulip account.
Root cause
GenericOpenIdConnectBackend maps incoming email claims to existing delivery_email addresses without verifying or rejecting an explicit email_verified=false claim.
Affected systems
Zulip Server through 12.1
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade to Zulip Server 12.2. If you cannot upgrade immediately, reconfigure or disable the Generic OpenID Connect provider so it only issues verified emails or stop trusting providers that return unverified email addresses.
$ /home/zulip/deployments/current/scripts/upgrade-zulip-stage-2 12.2AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.
References
- https://github.com/zulip/zulip/commit/68d2d9defa39f8af96a50fc7430efc34dee120b5
- https://github.com/zulip/zulip/commit/b40f191a8c71e74fcb471f71de6a1233de157102
- https://github.com/zulip/zulip/pull/39913
- https://github.com/zulip/zulip/releases/tag/12.2
- https://github.com/zulip/zulip/security/advisories/GHSA-xw9h-9rcm-hx4m