| id: GO-2026-6470 | |
| modules: | |
| - module: github.com/zitadel/zitadel | |
| non_go_versions: | |
| - fixed: 4.15.3 | |
| vulnerable_at: 1.87.5 | |
| summary: 'ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel' | |
| cves: | |
| - CVE-2026-56666 | |
| ghsas: | |
| - GHSA-992q-9gwp-7r79 | |
| references: | |
| - advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79 | |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-56666 | |
| - fix: https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f | |
| - web: https://github.com/zitadel/zitadel/releases/tag/v4.15.3 | |
| source: | |
| id: GHSA-992q-9gwp-7r79 | |
| created: 2026-09-15T11:09:32.550108-04:00 | |
| review_status: UNREVIEWED |