THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-992q-9gwp-7r79 (medium) — ZITADEL: Auto-linking by email: IdP-side email verification is not checked

[GHSA] GHSA-992q-9gwp-7r79 (medium) — ZITADEL: Auto-linking by email: IdP-side email verification is not checked

medgithub_advisoriesPublished 2026-09-11

GHSA-992q-9gwp-7r79 Severity: medium CVE: CVE-2026-56666

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

### Summary

A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not expl

MITRE ATT&CK techniques

Local AccountT1087.001
Local AccountT1136.001
Email AddressesT1589.002

Indicators of compromise

CVE-2026-56666cve
security@zitadel.comemail

Original source: https://github.com/advisories/GHSA-992q-9gwp-7r79