CyberRota Analysis
AI-GeneratedZITADEL's identity management platform prior to version 4.15.3 is vulnerable due to inadequate verification of email ownership when auto-linking external identity provider accounts to local user accounts. This flaw could allow an attacker to link their own account to a victim's local account using a victim's email address, potentially leading to unauthorized access. Organizations using ZITADEL should prioritize upgrading to version 4.15.3 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.