CVE-2026-56666: ZITADEL: Auto-linking by email: IdP-side email verification is not checked

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-10 · updated 2026-07-13
Weakness: CWE-287

Description

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.

Affected products

zitadel: before 4.15.3

References

https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f
https://github.com/zitadel/zitadel/releases/tag/v4.15.3
https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79

Get alerted when CVE-2026-56666 or the next vulnerability affects your stack