CVE-2026-56666: ZITADEL Auth Bypass Vulnerability

CVE-2026-56666 Overview

ZITADEL is an open source identity and access management platform. Versions prior to 4.15.3 contain an authentication flaw in the external identity provider (IdP) handler. The handler verifies that the local user's email is marked as verified, but it does not confirm that the external IdP validated ownership of the same email address before auto-linking accounts by email. An attacker who controls a permissive IdP account bearing a victim's email address can trigger auto-linking to the victim's local ZITADEL account. The issue is resolved in version 4.15.3. The weakness is classified under CWE-287: Improper Authentication.

Critical Impact
An attacker leveraging a permissive external IdP can link to and access a victim's ZITADEL account by presenting an unverified email address matching the victim.

Affected Products

ZITADEL identity management platform, all versions prior to 4.15.3
Deployments configured with AutoLinkingOption.EMAIL on external IdPs
Self-hosted and cloud ZITADEL installations relying on external IdP federation

Discovery Timeline

2026-07-10 - CVE-2026-56666 published to the National Vulnerability Database
2026-07-13 - CVE-2026-56666 last modified in the NVD database

Technical Details for CVE-2026-56666

Vulnerability Analysis

The vulnerability resides in ZITADEL's external identity provider handler, which manages federation with third-party IdPs. When AutoLinkingOption.EMAIL is configured, ZITADEL attempts to match an incoming external user to an existing local user by email address. The handler enforces that the local account's email is verified but omits an equivalent check on the external IdP-provided email. As a result, a login flow originating from an IdP that does not enforce email ownership can auto-link to a matching victim account.

Root Cause

The root cause is missing input validation on the trust boundary between the external IdP and the local user store. In internal/api/ui/login/external_provider_handler.go, the email match query executed against verified local addresses without inspecting externalUser.IsEmailVerified. The frontend server logic in apps/login/src/lib/server/idp-intent.ts mirrored the same omission, matching on addHumanUser?.email?.email without evaluating the verification case.

Attack Vector

An attacker registers or provisions an account at a permissive external IdP federated with a target ZITADEL tenant. The attacker sets that account's email to the victim's address without proving ownership. On initiating a federated login, ZITADEL matches the unverified external email to the victim's verified local account and auto-links them, granting the attacker interactive access. Exploitation requires no user interaction from the victim but depends on the presence of a federated IdP that does not enforce email verification.

typescript

// Patch: apps/login/src/lib/server/idp-intent.ts
   if (options?.autoLinking) {
     let foundUser;
     const email = addHumanUser?.email?.email;
+    const emailVerified = addHumanUser?.email?.verification?.case === "isVerified" && addHumanUser?.email?.verification?.value;
 
-    if (options.autoLinking === AutoLinkingOption.EMAIL && email) {
+    if (options.autoLinking === AutoLinkingOption.EMAIL && email && emailVerified) {
       foundUser = await listUsers({ serviceConfig, email, organizationId: organization }).then((response) => {
         return response.result ? response.result[0] : null;
       });

Source: ZITADEL commit c97012f

// Patch: internal/api/ui/login/external_provider_handler.go
 		}
 		queries = append(queries, usernameQuery)
 	case domain.AutoLinkingOptionEmail:
-		// Email will always be checked against verified email addresses.
+		// When checking for email matches, we need to make sure that both (the one from the IdP and the one in Zitadel)
+		// are verified to prevent potential account takeovers.
+		if !externalUser.IsEmailVerified {
+			return false, nil
+		}
 		emailQuery, err := query.NewUserVerifiedEmailSearchQuery(string(externalUser.Email))

Source: ZITADEL commit c97012f

Detection Methods for CVE-2026-56666

Indicators of Compromise

Unexpected idp.external.link or account link audit events associating a local user with a newly federated IdP identity.
Federated logins from IdPs where the external user's email_verified claim is false or absent, followed by successful ZITADEL session establishment.
New IdP-linked sessions preceding password reset or MFA enrollment changes on established accounts.

Detection Strategies

Review ZITADEL audit logs for human.user.idp.link.added events and correlate with the source IdP's email verification state.
Alert on any auto-link event where the external IdP did not assert email_verified=true in the identity token or user info response.
Baseline federated login sources per user and flag deviations where a user suddenly authenticates via a previously unused IdP.

Monitoring Recommendations

Ingest ZITADEL activity and audit logs into a centralized SIEM and retain IdP claim data for post-incident review.
Monitor for privilege changes, session creation, or token issuance immediately following a federated auto-link event.
Track version metadata across ZITADEL instances and alert on hosts running versions earlier than 4.15.3.

How to Mitigate CVE-2026-56666

Immediate Actions Required

Upgrade all ZITADEL instances to version 4.15.3 or later without delay.
Audit external IdP configurations and disable federation with any provider that does not enforce email verification.
Review recent IdP link events and unlink accounts that were auto-linked from unverified external emails.

Patch Information

The fix is available in ZITADEL Release v4.15.3. Technical details are documented in GitHub Security Advisory GHSA-992q-9gwp-7r79 and the corresponding remediation commit c97012f. The patch enforces that externalUser.IsEmailVerified is true before executing an email-based auto-link.

Workarounds

Disable AutoLinkingOption.EMAIL on external IdP configurations until the upgrade is applied.
Switch federated linking to username-based matching where feasible, since usernames are not asserted by third-party IdPs as ownership proofs.
Restrict federation to IdPs that are contractually or technically required to verify email ownership before issuing identity assertions.

bash

# Verify current ZITADEL version and confirm upgrade to 4.15.3
zitadel --version

# Example: disable email auto-linking on an IdP via ZITADEL Management API
curl -X PUT "https://$ZITADEL_DOMAIN/management/v1/idps/$IDP_ID" \
  -H "Authorization: Bearer $PAT" \
  -H "Content-Type: application/json" \
  -d '{"autoLinking": "AUTO_LINKING_OPTION_UNSPECIFIED"}'