CVE-2026-102893

Awaiting Analysis Awaiting Analysis - Queue

OpenID Connect Authentication Bypass in Zulip Server

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102893

EUVD

EUVD-2026-101287

Affected Vendors & Products

Vendor	Product	Version / Range
zulip	zulip	< 12.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

CVE-2026-102893 is an authentication bypass vulnerability in Zulip Server versions through 12.1. It occurs in the OpenID Connect (OIDC) login process where the system matches users to accounts based solely on the email claim from the identity provider without verifying if the email is confirmed (email_verified=false). This allows a misconfigured IdP to log users into accounts they don't control by providing an email address they don't own along with an unverified email claim.

Detection Guidance

To detect this vulnerability, check if your Zulip server is running a version prior to 12.2. Run: zulip-server --version. If the version is below 12.2, the system is vulnerable. Additionally, review OIDC authentication logs for failed login attempts where email_verified=false is present in IdP responses.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to gain access to accounts they don't own by leveraging a misconfigured identity provider. This could lead to data breaches, unauthorized access to sensitive conversations, or impersonation of legitimate users. The impact depends on the configuration of the identity provider and whether it emits unverified emails.

Compliance Impact

This vulnerability could potentially violate compliance requirements such as GDPR's data protection principles or HIPAA's access controls by allowing unauthorized access to user data. Organizations using affected Zulip versions with misconfigured OIDC providers may face compliance violations, data breaches, and associated penalties. The vulnerability specifically relates to improper authentication (CWE-287), which is a common compliance concern.

Mitigation Strategies

Upgrade Zulip Server to version 12.2 or later to address the OIDC authentication bypass issue.

Hi! I’m here to help you understand CVE-2026-102893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70