{"id":"GO-2026-6470","revision":null,"records":[{"revision":"15a1b8a4661e49cd8bca77f55d6a11d8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-56666","aliases":[],"title":"ZITADEL: Auto-linking by email: IdP-side email verification is not checked","description":"ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.","state":0,"publishedAt":"2026-07-10T17:37:37.137+00:00","modifiedAt":"2026-07-13T18:09:47.186+00:00","affected":[{"ecosystem":"Vendor product","name":"zitadel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"zitadel\",\n                    \"product\": \"zitadel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.15.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8,"severity":"MEDIUM"}],"references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79","https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f","https://github.com/zitadel/zitadel/releases/tag/v4.15.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-56666","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-56666","identifiers":["CVE-2026-56666"]},"retained":false,"historicalAffected":[]},{"revision":"706917e85e4848ffab2f8062d5d30668","observedAt":"2026-11-11T14:06:44.226+00:00","statement":{"source":"euvd","id":"EUVD-2026-42966","aliases":["CVE-2026-56666","GHSA-992q-9gwp-7r79"],"title":"ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same e…","description":"ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8,"severity":null}],"references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79","https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f","https://github.com/zitadel/zitadel/releases/tag/v4.15.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42966","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 10, 2026, 5:37:37 PM","dateUpdated":"Jul 13, 2026, 6:09:47 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42966","identifiers":["EUVD-2026-42966","CVE-2026-56666","GHSA-992q-9gwp-7r79"]},"retained":false,"historicalAffected":[]},{"revision":"5509df2360134dc59cf87f3e20aa63e9","observedAt":"2026-10-25T14:19:10.848+00:00","statement":{"source":"nvd","id":"CVE-2026-56666","aliases":[],"title":"ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same e…","description":"ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.","state":0,"publishedAt":"2026-07-10T18:16:24.15+00:00","modifiedAt":"2026-07-13T19:17:23.487+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8,"severity":"MEDIUM"}],"references":["https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f","https://github.com/zitadel/zitadel/releases/tag/v4.15.3","https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56666","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-287"],"productCriteria":[],"sourceDates":{"published":"2026-07-10T18:16:24.150","lastModified":"2026-07-13T19:17:23.487"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-56666","identifiers":["CVE-2026-56666"]},"retained":false,"historicalAffected":[]},{"revision":"95224d3e55034fd39d6fbbf1ff63067c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-992q-9gwp-7r79","aliases":["CVE-2026-56666","GO-2026-6470"],"title":" ZITADEL: Auto-linking by email: IdP-side email verification is not checked","description":"### Summary\n\nA flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not explicitly cross-check whether the incoming external identity provider (IdP) also verified that email address upstream.\n\n### Impact\n\nWhen a user logs in via an external identity provider, the system can automatically link them to an existing local account if their email addresses match. However, because the system fails to check if the external provider actually verified ownership of that email, a security risk is introduced if a loose or public provider is connected.\n\nIf an administrator enables email auto-linking for an external identity provider that allows anyone to sign up with an unverified email address, an attacker can exploit this behavior. By registering an account on that permissive provider using a victim's email address and logging in, the system will automatically link the attacker's federated identity to the victim's legitimate local account. This allows the attacker to log into the victim's account without requiring any interaction or confirmation from the victim.\n\nThis issue represents a configuration-dependent anomaly rather than an unconditioned attack vector. Because the scenario relies entirely on an explicit administrative choice to trust a permissive external directory and link accounts automatically based purely on email strings, the practical operational risk is classified as **Medium**. \n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.15.2` (including RC versions)\n* **3.x:** `3.0.0` through `3.4.12` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring that the external identity provider's email verification status is explicitly validated before allowing any automatic linking logic to proceed.\n\n* **4.x**: Upgrade to $\\ge$ [4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n* **3.x**: Upgrade to $\\ge$ [4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n\n### Workarounds\n\nIf an immediate upgrade is not possible, implement one of the following mitigations:\n\n* Disable auto-linking by email entirely by setting the option to `AUTO_LINKING_OPTION_UNSPECIFIED` on corresponding identity providers.\n* Audit external IdP configurations and restrict email auto-linking strictly to trusted enterprise identity directories (e.g., corporate Okta or Azure AD) where email verification is strictly enforced and managed by corporate policy.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to [Android-Login-Analysis](https://github.com/Android-Login-Analysis) and [Alejandro Yadlin](https://github.com/ayadlin) for reporting this vulnerability.","state":0,"publishedAt":"2026-09-11T22:13:21+00:00","modifiedAt":"2026-09-17T17:40:55.758919+00:00","affected":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.15.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79","https://nvd.nist.gov/vuln/detail/CVE-2026-56666","https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f","https://github.com/zitadel/zitadel","https://github.com/zitadel/zitadel/releases/tag/v4.15.3"],"sourceUrl":"https://github.com/advisories/GHSA-992q-9gwp-7r79","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-992q-9gwp-7r79","identifiers":["GHSA-992q-9gwp-7r79","CVE-2026-56666","GO-2026-6470"]},"retained":false,"historicalAffected":[]},{"revision":"108b0a4ee6b94fe5a769990780236121","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6470","aliases":["CVE-2026-56666","GHSA-992q-9gwp-7r79"],"title":"ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel","description":"ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel before v4.15.3.","state":0,"publishedAt":"2026-09-16T16:56:22+00:00","modifiedAt":"2026-09-17T17:30:12.8924163+00:00","affected":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79","https://nvd.nist.gov/vuln/detail/CVE-2026-56666","https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f","https://github.com/zitadel/zitadel/releases/tag/v4.15.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6470","license":"OSV · upstream source license applies","key":"osv:GO-2026-6470","identifiers":["GO-2026-6470","CVE-2026-56666","GHSA-992q-9gwp-7r79"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T07:09:48.0434594+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T07:09:48.0434594+00:00","lastSuccessAt":"2026-11-13T07:09:48.3275958+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:48.3277431+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-c5309b25400581525e35b5d686fde5eb801ba52451edf64385de1067c7c5e97b","complete":true,"records":424978,"lastAttemptAt":"2026-11-13T07:09:47.3634648+00:00","lastSuccessAt":"2026-11-13T06:55:18.981967+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:47.3634648+00:00","snapshotPublishedAt":"2026-11-13T06:26:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c400362982e04b6aa54109c6b458794c","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T07:19:26.5908907+00:00","lastSuccessAt":"2026-11-13T07:19:26.552+00:00","error":"356 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T07:19:26.552+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13490,"expectedIdentifiers":13846,"failedIdentifiers":356},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T07:09:48.0434594+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T07:09:48.0434594+00:00","lastSuccessAt":"2026-11-13T07:09:48.4741485+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:48.4741489+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-dad46f90d10c4b5890012c0a64d342dc","complete":true,"records":13793,"lastAttemptAt":"2026-11-13T07:09:49.8746887+00:00","lastSuccessAt":"2026-11-13T06:18:21.149+00:00","error":null,"lastVerifiedAt":"2026-11-13T06:18:21.149+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T07:09:47.7322763+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:47.7322763+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T07:09:47.5190756+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:47.5190756+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T07:09:47.8377123+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:47.8377123+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-178522b1ccf3a779bfdc323be85feb949f35ae83fc129db130584901ae0094bb","complete":true,"records":231768,"lastAttemptAt":"2026-11-13T07:09:47.6322837+00:00","lastSuccessAt":"2026-11-13T06:57:00.764342+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:47.6322837+00:00","snapshotPublishedAt":"2026-11-13T06:32:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}