DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-56666: CVE-2026-56666: Account Takeover via Improper Email Verification in ZITADEL Federated Identity Handler

#security #cve #cybersecurity

CVE-2026-56666: Account Takeover via Improper Email Verification in ZITADEL Federated Identity Handler

Vulnerability ID: CVE-2026-56666
CVSS Score: 4.8
Published: 2026-09-11

An improper authentication vulnerability (CWE-287) in ZITADEL's external identity provider handler before version 4.15.3 allows remote attackers to perform complete account takeover. When auto-linking by email is enabled, ZITADEL verifies that the local target account has a verified email address but fails to verify if the external provider confirmed ownership of that same email. Attackers can exploit this by registering an unverified account with a victim's email address on a permissive external provider, leading to unauthorized account binding and persistent access.

TL;DR

Unauthenticated remote attackers can takeover ZITADEL accounts by abusing a logical flaw where ZITADEL fails to verify the email ownership claim (email_verified) from federated identity providers during automatic account linking.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-287
  • Attack Vector: Network (AV:N)
  • CVSS Score: 4.8
  • EPSS Score: 0.00285 (Percentile: 20.90%)
  • Impact: Account Takeover / Authentication Bypass
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • ZITADEL Cloud Platform
  • ZITADEL Self-Hosted (Go-based authentication engine)
  • ZITADEL Node/TypeScript Login Server Application
  • ZITADEL: < 4.15.3 (Fixed in: 4.15.3)

Code Analysis

Commit: c97012f

Fix: Auto-linking by email requires external IdP-side email verification

--- a/internal/api/ui/login/external_provider_handler.go
+++ b/internal/api/ui/login/external_provider_handler.go
@@ -551,7 +551,11 @@
        }
        queries = append(queries, usernameQuery)
    case domain.AutoLinkingOptionEmail:
-       // Email will always be checked against verified email addresses.
+       // When checking for email matches, we need to make sure that both (the one from the IdP and the one in Zitadel)
+       // are verified to prevent potential account takeovers.
+       if !externalUser.IsEmailVerified {
+           return false, nil
+       }
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade ZITADEL deployments to version 4.15.3 or later
  • Disable the 'Auto-linking by email' option in Identity Provider configurations
  • Restrict integration to identity providers that strictly enforce email verification
  • Configure manual account linking as an alternative to automatic options

Remediation Steps:

  1. Access the deployment environment and run the package or container update command to target ZITADEL version 4.15.3.
  2. Navigate to the ZITADEL Console administration portal.
  3. Open Settings -> Identity Providers and locate active configuration setups.
  4. Toggle the Auto-linking settings away from 'Email' match types.
  5. Enforce mandatory initial verification within your custom IDP configurations if applicable.
  6. Query system event logs for retrospective occurrences of 'user.external.idp.added' to audit historical link operations.

References

Read the full report for CVE-2026-56666 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)