Zulip Server: Authentication bypass via unverified email in OpenID Connect login

Summary

Zulip Server's generic OpenID Connect backend does not reject an explicit email_verified=false claim from the identity provider. If a configured identity provider returns an email address the user does not control, an attacker who can authenticate through that provider may be logged into the existing Zulip account for that address. Exploitation requires a misconfigured trusted identity provider; deployments whose identity provider only asserts emails controlled by the user are not affected.

Affected

• Zulip Server through version 12.1 (CNA/NVD record: versions below 12.2)
• Possibly 12.0 and later, according to one aggregator; not yet confirmed against the vendor advisory
• Only installations using the generic OpenID Connect login backend (GenericOpenIdConnectBackend)

Fixed in

• Fixed in Zulip Server 12.2
• Current stable release line: 12.3 (not confirmed by the vendor whether it contains further changes for this issue)

Workaround

Unknown.

• No vendor-documented workaround found. Upgrading to 12.2 or later is the vendor's fix.
• Verify that your identity provider only asserts email addresses that users control.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found; absence of results is not proof that none exists.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Vendor rates the issue Low; the CNA CVSS 4.0 score is 9.1 (Critical).

Our recommendation

• Check whether any Zulip instance uses the generic OpenID Connect login backend.
• Upgrade affected instances to Zulip Server 12.2 or later.
• Verify that the identity provider only sends email addresses controlled by the users and does not send email_verified=false.
• Review logins for accounts whose email address matches an external identity, especially administrator accounts.
• If no Zulip instance uses OpenID Connect, no action is needed beyond normal patching.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Zulip commit 68d2d9d: Reject OIDC logins with an unverified email address github.com
• Zulip commit b40f191: Reject OIDC logins with an unverified email address github.com
• Zulip pull request 39913 github.com
• Zulip Server 12.2 release github.com
• GitHub Security Advisory GHSA-xw9h-9rcm-hx4m github.com
• Zulip Server 12.2 security release blog post blog.zulip.com
• Zulip authentication methods documentation zulip.readthedocs.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:36.