CVE-2026-56666CWE-287

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

Medium · published July 10, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00285 · 20.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-07-10T17:37Z
EPSS history
Timeline
  • 10 JUL 17:37Z
    ZITADEL: Auto-linking by email: IdP-side email verification is not checked
    cvelistv5