CVE-2026-56666: ZITADEL improper authentication in external identity provider auto-linking

CVE-2026-56666 · Severity: medium · CVSS 4.8 · Published 2026-07-10

ZITADEL is an identity and access management (IAM) platform that supports federated login through external identity providers. When administrators enable automatic account linking by email, ZITADEL fails to verify that the external provider actually confirmed email ownership. An attacker can exploit this by signing up on a permissive external provider with a victim's email address, then logging in to automatically hijack the victim's ZITADEL account without their knowledge or consent.

Technologies: github.com/zitadel/zitadel (Go), ZITADEL. Vendors: Go, ZITADEL.

Quick answers

Is CVE-2026-56666 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56666 being exploited in the wild.
How severe is CVE-2026-56666?
Medium severity, with a CVSS score of 4.8, published 10 July 2026.
Which products and versions are affected?
github.com/zitadel/zitadel (Go) < 4.15.3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.15.3; ZITADEL >= 3.0.0, < 4.15.3, 4.0.0 through 4.15.2; 3.0.0 through 3.4.12.
Is there a fix for CVE-2026-56666?
Yes. github.com/zitadel/zitadel (Go): upgrade to 4.15.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56666 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56666?
Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/zitadel/zitadel (Go): upgrade to 4.15.3 or later
    go get github.com/zitadel/zitadel@v4.15.3

Technical details

This is an improper authentication vulnerability (CWE-287) in ZITADEL's external identity provider handler. When auto-linking by email is enabled, the system checks that the local user's email is verified but does not cross-check whether the external IdP also verified that email upstream. An attacker can register on a loosely-configured external provider (one allowing unverified email signup) using a victim's email address. Upon federated login, ZITADEL automatically links the attacker's federated identity to any existing local account with a matching email, granting full account access. The attack requires no user interaction and network-reachable endpoints. The vulnerability affects versions 4.0.0–4.15.2 and 3.0.0–3.4.12; patches are available in 4.15.3 and later. The practical risk is configuration-dependent, requiring an administrator to have explicitly enabled email auto-linking with a permissive external provider.

Affected products

  • ZITADEL ZITADEL 4.0.0 through 4.15.2; 3.0.0 through 3.4.12

Identifiers

  • CVE-2026-56666
  • GHSA-992q-9gwp-7r79
  • GO-2026-6470

Timeline

  • 2026-06-22: disclosed
  • 2026-09-11: advisory
  • 2026-09-11: patched: Patched in version 4.15.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.