{"id":"CVE-2026-102893","summary":"Zulip: OpenID Connect authentication ignores the email_verified claim","details":"Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.","aliases":["GHSA-xw9h-9rcm-hx4m"],"modified":"2026-10-15T02:47:19.861157510Z","published":"2026-10-14T15:49:03.442Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-287"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102893.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102893.json"},{"type":"FIX","url":"https://github.com/zulip/zulip/commit/68d2d9defa39f8af96a50fc7430efc34dee120b5"},{"type":"FIX","url":"https://github.com/zulip/zulip/commit/b40f191a8c71e74fcb471f71de6a1233de157102"},{"type":"FIX","url":"https://github.com/zulip/zulip/pull/39913"},{"type":"WEB","url":"https://github.com/zulip/zulip/releases/tag/12.2"},{"type":"ADVISORY","url":"https://github.com/zulip/zulip/security/advisories/GHSA-xw9h-9rcm-hx4m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102893"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zulip/zulip","events":[{"introduced":"0"},{"fixed":"1e73e1d754761b73c18135a3f25d0673f31cd8b3"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"12.2"}],"source":"AFFECTED_FIELD"}}],"versions":["12.1","12.0","12.0-beta2","12.0-beta1","12.0-dev","11.0","11.0-beta2","11.0-beta1","11.0-dev","10.0","10.0-beta2","10.0-beta1","9.0","9.0-beta1","8.0","9.0-dev","8.0-beta2","8.0-beta1","8.0-dev","7.0","7.0-beta3","shared-0.0.18","shared-0.0.17","7.0-dev","6.0","shared-0.0.16","shared-0.0.15","shared-0.0.14","shared-0.0.13","shared-0.0.12","shared-0.0.11","shared-0.0.10","6.0-dev","5.0","shared-0.0.9","shared-0.0.8","shared-0.0.7","shared-0.0.6","4.0","5.0-dev","shared-0.0.5","shared-0.0.4","shared-0.0.3","4.0-dev","3.0","3.0-rc2","3.0-rc1","3.0-dev","2.2-dev","2.1.0","2.1.0-rc1","shared-0.0.2","shared-0.0.1","2.0.0","2.1-dev","2.0.0-rc1","1.9.0","1.9.0-rc3","1.9.0-rc2","1.8.0","1.8.0-rc1","1.7.0","1.6.0","1.5.0","1.4.0","1.3.13","1.3.11","1.3.10","1.3.9","1.3.8","1.3.7","1.3.6","1.3.5","1.3.4","1.3.3","1.3.2","1.3.1","1.3.0","enterprise-1.2.0","enterprise-1.1.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102893.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}