{"cve":"CVE-2026-56666","nvd":{"published":"2026-07-10T18:16:24.150","modified":"2026-07-13T19:17:23.487","status":"Deferred","description":"ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8},"cwes":["CWE-287"],"references":["https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f","https://github.com/zitadel/zitadel/releases/tag/v4.15.3","https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:44:02.134301115+00:00"},"epss":{"cve":"CVE-2026-56666","score":0.00285,"percentile":0.21098,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-992q-9gwp-7r79","url":"https://osv.dev/vulnerability/GHSA-992q-9gwp-7r79","summary":" ZITADEL: Auto-linking by email: IdP-side email verification is not checked","modified":"2026-09-17T17:40:55.758918973Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["<4.15.3"],"fixed":["4.15.3"]}]},{"id":"GO-2026-6470","url":"https://osv.dev/vulnerability/GO-2026-6470","summary":"ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel","modified":"2026-09-17T17:30:12.892416260Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}