CVE-2026-56666: ZITADEL: Auto-linking by email: IdP-side email verification is not checked

September 11, 2026

A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user’s email is verified, but does not explicitly cross-check whether the incoming external identity provider (IdP) also verified that email address upstream.

References

github.com/advisories/GHSA-992q-9gwp-7r79
github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f
github.com/zitadel/zitadel/releases/tag/v4.15.3
github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79
nvd.nist.gov/vuln/detail/CVE-2026-56666

Code Behaviors & Features

Detect and mitigate CVE-2026-56666 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →