What is the CVSS score of CVE-2026-56666?

CVE-2026-56666 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-56666?

Yes, a public proof-of-concept exploit is available for CVE-2026-56666. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-56666?

Yes, a patch is available for CVE-2026-56666. Update the affected software to the latest version immediately.

ZITADEL CVE-2026-56666

EUVD-2026-42966 MEDIUM

Improper Authentication (CWE-287)

2026-07-10 GitHub_M

GHSA-992q-9gwp-7r79

Authentication Bypass Zitadel

4.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

7.4 HIGH

Account takeover achieves full victim-account access, warranting C:H/I:H; AC:H retained due to permissive-IdP prerequisite.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 19:01 EUVD

Analysis Generated

Jul 10, 2026 - 18:36 vuln.today

DescriptionCVE.org

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.

AnalysisAI

Account takeover in ZITADEL's external identity provider auto-linking logic prior to version 4.15.3 allows an unauthenticated network attacker to hijack a victim's local ZITADEL account. The handler confirms that the local user's email is verified but fails to require the external IdP to also confirm ownership of that same email address before completing the link - meaning an attacker who registers a victim's email on a permissive external IdP (one that does not enforce email verification) can silently gain full access to the victim's ZITADEL account. No public exploit has been identified at time of analysis; the fix is available in the vendor-released patch v4.15.3.

Technical ContextAI

ZITADEL (cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*) is an open-source cloud-native identity and access management platform supporting federated authentication via external identity providers (IdPs) such as OIDC/OAuth2 and SAML providers. The auto-linking feature matches external IdP accounts to existing local accounts using email address as a correlation key. The root cause is CWE-287 (Improper Authentication): the application relies solely on local email verification status rather than requiring the IdP to attest ownership of the email during the current authentication session. Because some IdPs are 'permissive' - they allow users to register unverified email addresses - the trust boundary between the external claim and local account truth is broken. The flaw exists in the external identity provider handler code path, fixed in commit c97012f0c5dc2fe960ae6e940cbea23229f0557f.

RemediationAI

The primary fix is to upgrade ZITADEL to version 4.15.3 or later, which is available at https://github.com/zitadel/zitadel/releases/tag/v4.15.3. The underlying code change is documented in commit c97012f0c5dc2fe960ae6e940cbea23229f0557f. As a compensating control for organizations that cannot immediately patch, administrators should audit all configured external IdPs and remove or disable any that do not enforce email verification - this eliminates the permissive provider prerequisite required for exploitation. Disabling the auto-linking-by-email feature entirely (if ZITADEL exposes such a configuration) removes the attack surface at the cost of requiring manual account linking workflows. Note that disabling external IdPs entirely would break federated SSO for all users relying on those providers.