https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 16:37:45 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336115 EUVD-2026-336115 https://cve.radiocsirt.org/vuln/euvd-2026-336115 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56666 <p>ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL&#39;s external identity provider handler checks that the local user&#39;s email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim&#39;s local account. This issue is fixed in version 4.15.3.</p> <p>ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL&#39;s external identity provider handler checks that the local user&#39;s email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim&#39;s local account. This issue is fixed in version 4.15.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56666 https://cve.radiocsirt.org/vuln/ghsa-992q-9gwp-7r79 <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user&#39;s email is verified, but does not explicitly cross-check whether the incoming external identity provider (IdP) also verified that email address upstream.</p> <p>### Impact</p> <p>When a user logs in via an external identity provider, the system can automatically link them to an existing local account if their email addresses match. However, because the system fails to check if the external provider actually verified ownership of that email, a security risk is introduced if a loose or public provider is connected.</p> <p>If an administrator enables email auto-linking for an external identity provider that allows anyone to sign up with an unverified email address, an attacker can exploit this behavior. By registering an account on that permissive provider using a victim&#39;s email address and logging in, the system will automatically link the attacker&#39;s federated identity to the victim&#39;s legitimate local account. This allows the attacker to log into the victim&#39;s account without requiring any interaction or confirmation from the victim.</p> <p>This issue represents a configuration-dependent anomaly rather than an unconditioned attack vector. Because the scenario relies entirely on an explicit administrative choice to trust a permissive external directory and link accounts automatic…</p> <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user&#39;s email is verified, but does not explicitly cross-check whether the incoming external identity provider (IdP) also verified that email address upstream.</p> <p>### Impact</p> <p>When a user logs in via an external identity provider, the system can automatically link them to an existing local account if their email addresses match. However, because the system fails to check if the external provider actually verified ownership of that email, a security risk is introduced if a loose or public provider is connected.</p> <p>If an administrator enables email auto-linking for an external identity provider that allows anyone to sign up with an unverified email address, an attacker can exploit this behavior. By registering an account on that permissive provider using a victim&#39;s email address and logging in, the system will automatically link the attacker&#39;s federated identity to the victim&#39;s legitimate local account. This allows the attacker to log into the victim&#39;s account without requiring any interaction or confirmation from the victim.</p> <p>This issue represents a configuration-dependent anomaly rather than an unconditioned attack vector. Because the scenario relies entirely on an explicit administrative choice to trust a permissive external directory and link accounts automatic…</p> https://cve.radiocsirt.org/vuln/ghsa-992q-9gwp-7r79