CVE-2026-56666Medium· 4.8▾ SunlitZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the sam…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/zitadel/zitadel < 4.15.3Patched in:
github.com/zitadel/zitadel 4.15.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56668High· 8.1ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
CVE-2026-76081Medium· 5.5ZITADEL is an open source identity management platform
CVE-2023-47111High· 7.3ZITADEL race condition in lockout policy execution
CVE-2023-22492Medium· 5.9Zitadel RefreshToken invalidation vulnerability
CVE-2023-49097High· 8.1ZITADEL Account Takeover via Malicious Host Header Injection
CVE-2026-56665Medium· 4.2ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider