Open Source Collaboration Tool Vulnerability in Zulip Server
CVE-2026-102893

9.1CRITICAL

Key Information:

Vendor

Zulip

Status
Zulip
Vendor
CVE Published:
14 October 2026

What is CVE-2026-102893?

Zulip Server prior to version 12.2 contains a vulnerability where the GenericOpenIdConnectBackend improperly handles the email_verified claim. If an identity provider returns an email address that does not belong to the active user and marks the email_verified field as false, it could allow unauthorized access to the existing account associated with that email. This scenario typically arises from a misconfiguration in trusted identity providers. Deployments using correct configurations that only issue email addresses controlled by users are not affected. This issue poses a potential risk to user account security and has been resolved in version 12.2.

Affected Version(s)

zulip < 12.2

References

https://github.com/zulip/zulip/security/advisories/GHSA-x...
x_refsource_CONFIRM
https://github.com/zulip/zulip/pull/39913
x_refsource_MISC
https://github.com/zulip/zulip/commit/68d2d9defa39f8af96a...
x_refsource_MISC

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.