CVE-2026-102893

{
  "etk_id": "ETK-2026-1587",
  "cve_id": "CVE-2026-102893",
  "display_id": "CVE-2026-102893",
  "ghsa_id": "GHSA-xw9h-9rcm-hx4m",
  "euvd_id": "EUVD-2026-101287",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OpenID Connect account impersonation in Zulip Server",
  "summary": "Zulip Server through 12.1 can associate an OpenID Connect login with an existing account using an email claim that the identity provider marks as unverified. An attacker may access another user's account if the configured trusted identity provider can issue an uncontrolled email address; deployments whose provider only issues user-controlled addresses are not affected.",
  "mitigation": "Upgrade Zulip Server to version 12.2. Until upgraded, ensure trusted OpenID Connect providers issue email addresses only to users who control them.",
  "vendor": "zulip",
  "product": "zulip",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 12.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "12.2"
      ],
      "package_name": "Zulip server",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0039,
  "epss_percentile": 0.3162,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 67.87714511666667,
  "t0_at": "2026-10-14T15:49:03.442000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T15:49:03.442000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T15:49:03.442000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102893"
    }
  }
}