{"uuid": "45569dd9-5571-4837-af12-519a4be81b50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56666", "type": "seen", "source": "https://gist.github.com/alon710/98e409473d94480a44fb95ac0ba5823f", "content": "# CVE-2026-56666: CVE-2026-56666: Account Takeover via Improper Email Verification in ZITADEL Federated Identity Handler\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56666\n\n## Summary\nAn improper authentication vulnerability (CWE-287) in ZITADEL's external identity provider handler before version 4.15.3 allows remote attackers to perform complete account takeover. When auto-linking by email is enabled, ZITADEL verifies that the local target account has a verified email address but fails to verify if the external provider confirmed ownership of that same email. Attackers can exploit this by registering an unverified account with a victim's email address on a permissive external provider, leading to unauthorized account binding and persistent access.\n\n## TL;DR\nUnauthenticated remote attackers can takeover ZITADEL accounts by abusing a logical flaw where ZITADEL fails to verify the email ownership claim (email_verified) from federated identity providers during automatic account linking.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 4.8\n- **EPSS Score**: 0.00285 (Percentile: 20.90%)\n- **Impact**: Account Takeover / Authentication Bypass\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- ZITADEL Cloud Platform\n- ZITADEL Self-Hosted (Go-based authentication engine)\n- ZITADEL Node/TypeScript Login Server Application\n- **ZITADEL**: < 4.15.3 (Fixed in: `4.15.3`)\n\n## Mitigation\n\n- Upgrade ZITADEL deployments to version 4.15.3 or later\n- Disable the 'Auto-linking by email' option in Identity Provider configurations\n- Restrict integration to identity providers that strictly enforce email verification\n- Configure manual account linking as an alternative to automatic options\n\n**Remediation Steps:**\n1. Access the deployment environment and run the package or container update command to target ZITADEL version 4.15.3.\n2. Navigate to the ZITADEL Console administration portal.\n3. Open Settings -> Identity Providers and locate active configuration setups.\n4. Toggle the Auto-linking settings away from 'Email' match types.\n5. Enforce mandatory initial verification within your custom IDP configurations if applicable.\n6. Query system event logs for retrospective occurrences of 'user.external.idp.added' to audit historical link operations.\n\n## References\n\n- [NVD - CVE-2026-56666 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-56666)\n- [CVE.org - CVE-2026-56666 Record](https://www.cve.org/CVERecord?id=CVE-2026-56666)\n- [ZITADEL Release Tag v4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56666) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T00:01:14.475001Z"}