GO-2026-6470

vendorUSosv

ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel

view advisory published 2026-09-16Licence: per source

ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/zitadel/zitadel before v4.15.3.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2026-56666US——
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not ve…
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan