CVE-2025-31478: Zulip Authentication Backend Configuration Bypass
First published: Wed Apr 16 2025(Updated: )
Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a single-sign on authentication backend, meaning the organization places no restrictions on email address domains or invitations being required to join, but has disabled the EmailAuthBackend that is used for email/password authentication. A bug in the Zulip server means that it is possible to create an account in such organizations, without having an account with the configured SSO authentication backend. This issue is patched in version 10.2. A workaround includes requiring invitations to join the organization prevents the vulnerability from being accessed.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zulip Server | <10.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-31478?
CVE-2025-31478 has a high severity rating due to its potential impact on unauthorized account creation.
How do I fix CVE-2025-31478?
To fix CVE-2025-31478, ensure proper restrictions are in place for email domains and invitations during account creation.
Who is affected by CVE-2025-31478?
Organizations using Zulip Server versions prior to 10.2 are affected by CVE-2025-31478.
What can attackers do with CVE-2025-31478?
Attackers can create unauthorized accounts using any email address due to the lack of domain restrictions.
Is there a patch available for CVE-2025-31478?
Yes, a patch is available that addresses the vulnerability for Zulip Server versions 10.2 and later.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/source
- agent/severity
- agent/last-modified-date
- agent/author
- agent/tags
- agent/event
- vendor/zulip
- canonical/zulip server