{"schema":"threatline.record/2","record":{"id":"CVE-2026-102893","aliases":["GHSA-xw9h-9rcm-hx4m"],"summary":"Zulip: OpenID Connect authentication ignores the email_verified claim","details":"Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.","categories":["Unclassified"],"product":"zulip","vendor":"zulip","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102893","source_modified_at":"2026-10-15T19:06:20.918Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"zulip","vendor":"zulip","versions":[{"status":"affected","version":"< 12.2"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/zulip/zulip/security/advisories/GHSA-xw9h-9rcm-hx4m","source_modified_at":"2026-09-29T20:35:45Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"","name":"Zulip server"},"range":"<= 12.1"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/zulip/zulip/security/advisories/GHSA-xw9h-9rcm-hx4m","source_modified_at":"2026-09-29T20:35:45Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"","name":"Zulip server"},"version":"12.2"}],"cvss":9.1,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.0039,"percentile":0.31891,"score_date":"2026-10-23"},"published_at":"2026-10-14T15:49:03.442Z","modified_at":"2026-10-15T19:06:20.918Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-102893","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T19:06:20.918Z"},{"source":"GitHub Advisory Database","url":"https://github.com/zulip/zulip/security/advisories/GHSA-xw9h-9rcm-hx4m","fetched_at":"2026-10-24T00:31:04.721601Z","source_modified_at":"2026-09-29T20:35:45Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102893","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/zulip/zulip/security/advisories/GHSA-xw9h-9rcm-hx4m","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/zulip/zulip/pull/39913","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/zulip/zulip/commit/68d2d9defa39f8af96a50fc7430efc34dee120b5","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/zulip/zulip/commit/b40f191a8c71e74fcb471f71de6a1233de157102","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/zulip/zulip/releases/tag/12.2","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-15T19:05:46.384884Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T19:06:20.918Z","content_hash":"743bd7d35a7a5377e2e6d10d41964885cfcae2ddbe97c05efbf8453ad94fa4d0"}}