CVE-2026-56666— ZITADEL: Auto-linking by email: IdP-side email verification is not checked
Possible ATT&CK Techniques 1AI
T1136.002 · Domain AccountGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-56666
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ZITADEL: Auto-linking by email: IdP-side email verification is not checked
Source: NVD (National Vulnerability Database)
Vulnerability Description
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
认证机制不恰当
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-56666
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56666
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-56666 (1)
Vendor Advisories for CVE-2026-56666 (1)
Vendor Pages for CVE-2026-56666 (1)
- 🔗 Release v4.15.3 · zitadel/zitadel · GitHubx_refsource_MISC
Same Patch Batch · zitadel · 2026-07-10 · 9 CVEs total
| CVE-2026-56668 | 8.1 HIGH | ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange |
| CVE-2026-55672 | 7.4 HIGH | ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token f |
| CVE-2026-56667 | 7.3 HIGH | ZITADEL: Stored XSS via Default URI Redirect in Login V2 |
| CVE-2026-55669 | 4.2 MEDIUM | ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider |
| CVE-2026-56665 | 4.2 MEDIUM | ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider |
| CVE-2026-56664 | 4.2 MEDIUM | ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider |
| CVE-2026-55670 | ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers | |
| CVE-2026-55671 | ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Component |
IV. Related Vulnerabilities
Same product: zitadel
- CVE-2026-56668
ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 T - CVE-2026-56667
ZITADEL: Stored XSS via Default URI Redirect in Login V2 - CVE-2026-56665
ZITADEL: Missing Token Expiration (`exp`) Validation in JWT - CVE-2026-56664
ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) - CVE-2026-55672
ZITADEL: Missing client_id binding in OIDC authorization cod
Same vendor: zitadel
- CVE-2026-56668
ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 T - CVE-2026-56667
ZITADEL: Stored XSS via Default URI Redirect in Login V2 - CVE-2026-56665
ZITADEL: Missing Token Expiration (`exp`) Validation in JWT - CVE-2026-56664
ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) - CVE-2026-55672
ZITADEL: Missing client_id binding in OIDC authorization cod
Same weakness: CWE-287
- CVE-2026-12761
miniOrange Social Login and Register (Discord, Google, Twitt - CVE-2026-57216
RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enf - CVE-2026-55377
Logto: Account Center MFA management step-up bypass via WebA - CVE-2026-59151
Prowler: SAML Domain Claiming Enables Cross-Tenant Account T - CVE-2026-55672
ZITADEL: Missing client_id binding in OIDC authorization cod
V. Comments for CVE-2026-56666
No comments yet