Skip to content
OpenAdvisories

Vendor

zulip

42 known vulnerabilities.

Products

zulip 37 Zulip Server 2 zulip/zulip 2 zulip-mobile 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-102893

    Zulip: OpenID Connect authentication ignores the email_verified claim

    Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If …

    zulip zulip