CVE-2026-102893: Zulip: OpenID Connect authentication ignores the email_verified claim
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's deliveryemail without rejecting an explicitly false emailverified claim. If a configured identity provider returns an email address that the authenticating user does not control together with emailverified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zulip Serverto a version that resolves this vulnerability.Fixed in 12.2
Event History
Frequently Asked Questions
Which deployments are exposed to account takeover?
Deployments using GenericOpenIdConnectBackend through Zulip Server 12.1 are exposed only if their trusted identity provider can return an email address not controlled by the authenticating user while setting email_verified=false. Deployments whose authoritative identity provider emits only user-controlled email addresses are not affected.
What must an attacker be able to do to exploit this issue?
The attacker must authenticate through the configured identity provider and obtain an assertion containing the delivery email address of an active Zulip account that they do not control, with email_verified explicitly set to false. Zulip then matches that email to the existing active account.
What is the remediation?
Upgrade Zulip Server to version 12.2, which fixes the issue. If an immediate upgrade is not possible, ensure the trusted identity provider only issues email claims for addresses controlled by the authenticating user.