{"metadata": {"vulnerability": "CVE-2026-102893", "count": 12, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-29T17:34:42.743Z", "date_only": false, "value": "2026-09-29T17:34:42.743Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-102893", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T15:49:03.442Z", "date_only": false, "value": "2026-10-14T15:49:03.442Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-102893", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T15:49:03.442Z", "date_only": false, "value": "2026-10-14T15:49:03.442Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-102893", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T16:17:29.987Z", "date_only": false, "value": "2026-10-14T16:17:29.987", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102893", "record": "FKIE_CVE-2026-102893", "field": "published"}, {"timestamp": "2026-10-14T17:30:05.494Z", "date_only": false, "value": "2026-10-14T17:30:05.494844Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxu3642qkz2q", "record": "CVE-2026-102893", "field": "creation_timestamp", "uuid": "9feb7826-603a-4b8d-ac13-913dc0074833", "content": "CVE-2026-102893 - zulip\nIn Zulip Server versions up to 12.1, the login process does not check whether the identity provider says the email address is verified. If a trusted provider returns an email the user doesn't\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#zulip #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxu3642qkz2q"}, {"timestamp": "2026-10-14T18:09:14.858Z", "date_only": false, "value": "2026-10-14T18:09:14.858652Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxu5e4klje22", "record": "CVE-2026-102893", "field": "creation_timestamp", "uuid": "63018b92-f7a4-44c8-9670-9e8b166d7b96", "content": "\ud83d\udea8 CVE-2026-102893 \u2014 CVSS 9.1 CRITICAL\n\nZulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnec...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-102893\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxu5e4klje22"}, {"timestamp": "2026-10-14T20:56:53.055Z", "date_only": false, "value": "2026-10-14T20:56:53.055970Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441259937826683", "record": "CVE-2026-102893", "field": "creation_timestamp", "uuid": "3e08c8fb-0c77-4904-8724-080be3831a03", "content": "CVE-2026-102893 Zulip: OpenID Connect authentication ignores the email_verified claim Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.\nhttps://www.cve.org/CVERecord?id=CVE-2026-102893https://github.com/zulip/zulip/security/advisories/GHSA-xw9h-9rcm-hx4mhttps://github.com/zulip/zulip/pull/39913https://github.com/zulip/zulip/commit/68d2d9defa39f8af96a50fc7430efc34dee120b5https://github.com/zulip/zulip/commit/b40f191a8c71e74fcb471f71de6a1233de157102https://github.com/zulip/zulip/releases/tag/12.2#zulip#CVE_2026_102893#bot", "url": "https://infosec.exchange/users/cve/statuses/117441259937826683"}, {"timestamp": "2026-10-15T19:05:46.384Z", "date_only": false, "value": "2026-10-15T19:05:46.384884Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102893", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T19:05:46.384Z", "date_only": false, "value": "2026-10-15T19:05:46.384884Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102893", "record": "FKIE_CVE-2026-102893", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T19:06:20.918Z", "date_only": false, "value": "2026-10-15T19:06:20.918Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-102893", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T19:06:20.918Z", "date_only": false, "value": "2026-10-15T19:06:20.918Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102893", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T20:02:37.630Z", "date_only": false, "value": "2026-10-16T20:02:37.630", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102893", "record": "FKIE_CVE-2026-102893", "field": "lastModified"}]}