{"vulnerability": "cve-2026-5666", "sightings": [{"uuid": "ef720454-3c89-42ab-a6e6-587da495d5b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56663", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpa4kyjvut2c", "content": "CVE-2026-56663 - AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access\nCVE ID : CVE-2026-56663\n \n Published : June 26, 2026, 4:04 p.m. | 7\u00a0hours, 6\u00a0minutes ago\n \n Description : AutoGPT is a workflow automation platform for c...", "creation_timestamp": "2026-06-26T23:40:24.090028Z"}, {"uuid": "2000b1b8-c9ef-4fb7-9edc-c27897ad018c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56663", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpaos5yvxe2c", "content": "CVE-2026-56663 - SSRF bypass in AutoGPT allows authenticated users to access internal networks. CVSS 8.5. No patch available. Block special-use IPs and restrict access immediately. #CVE #AutoGPT #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-56663/", "creation_timestamp": "2026-06-27T05:06:32.604862Z"}, {"uuid": "908ea7eb-62d7-47d7-a221-f3f25204de4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56669", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq65jzfhdo2e", "content": "CVE-2026-56669 - Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict\nCVE ID : CVE-2026-56669\n \n Published : July 8, 2026, 8:25 p.m. | 34\u00a0minutes ago\n \n Description : Elysia is a Typescript framework for request validation, type inference, OpenAPI documentati...", "creation_timestamp": "2026-07-08T22:17:37.639409Z"}, {"uuid": "b3d5804e-2032-4a53-9e4b-912ba278c6df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56664", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfetpy3u2s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56664 \u0432 ZITADEL: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/44785777-4A1D-4A9C-9FC9-C877A496E3B2", "creation_timestamp": "2026-07-11T00:21:12.370793Z"}, {"uuid": "589af16e-dade-4c9f-b717-5d1292fbed97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56665", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdffwzpex2c", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56665 \u0432 ZITADEL: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/C5E529E5-C93C-48A7-AB45-638229788BAC", "creation_timestamp": "2026-07-11T00:21:49.435911Z"}, {"uuid": "713d48fd-f01a-4423-a62a-15f319565f04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56666", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfgkuphj2i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56666 \u0432 ZITADEL: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/37DEB6E4-3620-4C31-A837-5DE5F651A499", "creation_timestamp": "2026-07-11T00:22:10.013042Z"}, {"uuid": "52a3d252-95fa-48f5-aa08-397ab9ed7841", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56668", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfm6nrb62e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56668 \u0432 ZITADEL: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/C9739B81-1592-4C91-95B7-000FE181E9EE", "creation_timestamp": "2026-07-11T00:25:21.952247Z"}, {"uuid": "3748ce91-d33b-4422-968d-70b6369fda30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56668", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqfalk4a2i2w", "content": "\ud83d\udfe0 CVE-2026-56668 - High (8.1)\n\nZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token E...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56668/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-11T18:00:48.477087Z"}, {"uuid": "ff86885d-ffba-46a2-b65f-de978504b555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56666", "type": "seen", "source": "https://gist.github.com/alon710/98e409473d94480a44fb95ac0ba5823f", "content": "# CVE-2026-56666: CVE-2026-56666: Account Takeover via Improper Email Verification in ZITADEL Federated Identity Handler\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56666\n\n## Summary\nAn improper authentication vulnerability (CWE-287) in ZITADEL's external identity provider handler before version 4.15.3 allows remote attackers to perform complete account takeover. When auto-linking by email is enabled, ZITADEL verifies that the local target account has a verified email address but fails to verify if the external provider confirmed ownership of that same email. Attackers can exploit this by registering an unverified account with a victim's email address on a permissive external provider, leading to unauthorized account binding and persistent access.\n\n## TL;DR\nUnauthenticated remote attackers can takeover ZITADEL accounts by abusing a logical flaw where ZITADEL fails to verify the email ownership claim (email_verified) from federated identity providers during automatic account linking.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 4.8\n- **EPSS Score**: 0.00285 (Percentile: 20.90%)\n- **Impact**: Account Takeover / Authentication Bypass\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- ZITADEL Cloud Platform\n- ZITADEL Self-Hosted (Go-based authentication engine)\n- ZITADEL Node/TypeScript Login Server Application\n- **ZITADEL**: < 4.15.3 (Fixed in: `4.15.3`)\n\n## Mitigation\n\n- Upgrade ZITADEL deployments to version 4.15.3 or later\n- Disable the 'Auto-linking by email' option in Identity Provider configurations\n- Restrict integration to identity providers that strictly enforce email verification\n- Configure manual account linking as an alternative to automatic options\n\n**Remediation Steps:**\n1. Access the deployment environment and run the package or container update command to target ZITADEL version 4.15.3.\n2. Navigate to the ZITADEL Console administration portal.\n3. Open Settings -> Identity Providers and locate active configuration setups.\n4. Toggle the Auto-linking settings away from 'Email' match types.\n5. Enforce mandatory initial verification within your custom IDP configurations if applicable.\n6. Query system event logs for retrospective occurrences of 'user.external.idp.added' to audit historical link operations.\n\n## References\n\n- [NVD - CVE-2026-56666 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-56666)\n- [CVE.org - CVE-2026-56666 Record](https://www.cve.org/CVERecord?id=CVE-2026-56666)\n- [ZITADEL Release Tag v4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56666) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-11T23:31:37.936293Z"}, {"uuid": "45569dd9-5571-4837-af12-519a4be81b50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56666", "type": "seen", "source": "https://gist.github.com/alon710/98e409473d94480a44fb95ac0ba5823f", "content": "# CVE-2026-56666: CVE-2026-56666: Account Takeover via Improper Email Verification in ZITADEL Federated Identity Handler\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56666\n\n## Summary\nAn improper authentication vulnerability (CWE-287) in ZITADEL's external identity provider handler before version 4.15.3 allows remote attackers to perform complete account takeover. When auto-linking by email is enabled, ZITADEL verifies that the local target account has a verified email address but fails to verify if the external provider confirmed ownership of that same email. Attackers can exploit this by registering an unverified account with a victim's email address on a permissive external provider, leading to unauthorized account binding and persistent access.\n\n## TL;DR\nUnauthenticated remote attackers can takeover ZITADEL accounts by abusing a logical flaw where ZITADEL fails to verify the email ownership claim (email_verified) from federated identity providers during automatic account linking.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 4.8\n- **EPSS Score**: 0.00285 (Percentile: 20.90%)\n- **Impact**: Account Takeover / Authentication Bypass\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- ZITADEL Cloud Platform\n- ZITADEL Self-Hosted (Go-based authentication engine)\n- ZITADEL Node/TypeScript Login Server Application\n- **ZITADEL**: < 4.15.3 (Fixed in: `4.15.3`)\n\n## Mitigation\n\n- Upgrade ZITADEL deployments to version 4.15.3 or later\n- Disable the 'Auto-linking by email' option in Identity Provider configurations\n- Restrict integration to identity providers that strictly enforce email verification\n- Configure manual account linking as an alternative to automatic options\n\n**Remediation Steps:**\n1. Access the deployment environment and run the package or container update command to target ZITADEL version 4.15.3.\n2. Navigate to the ZITADEL Console administration portal.\n3. Open Settings -> Identity Providers and locate active configuration setups.\n4. Toggle the Auto-linking settings away from 'Email' match types.\n5. Enforce mandatory initial verification within your custom IDP configurations if applicable.\n6. Query system event logs for retrospective occurrences of 'user.external.idp.added' to audit historical link operations.\n\n## References\n\n- [NVD - CVE-2026-56666 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-56666)\n- [CVE.org - CVE-2026-56666 Record](https://www.cve.org/CVERecord?id=CVE-2026-56666)\n- [ZITADEL Release Tag v4.15.3](https://github.com/zitadel/zitadel/releases/tag/v4.15.3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56666) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T00:01:14.475001Z"}, {"uuid": "9102db34-530d-4cb2-b143-135c8d352720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56665", "type": "seen", "source": "https://gist.github.com/alon710/238c8eedad7470353ae0c3d6c2eceacc", "content": "# CVE-2026-56665: CVE-2026-56665: Logical Validation Bypass in ZITADEL External JWT Identity Provider\n\n> **CVSS Score:** 4.2\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56665\n\n## Summary\nA logical verification flaw in ZITADEL's external JWT Identity Provider validation allows attackers to bypass session expiration checks. If an incoming JWT lacks the 'exp' claim, the system skips validation entirely, creating an indefinitely valid session. This issue has been addressed in versions 3.4.12 and 4.15.2.\n\n## TL;DR\nZITADEL failed to enforce expiration checks when incoming JWTs lacked the 'exp' claim, allowing indefinite session validity and potential hijacking.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-613\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.2\n- **EPSS Score**: 0.00266 (Percentile: 18.42%)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n- **Affected Component**: internal/idp/providers/jwt/session.go\n\n## Affected Systems\n\n- ZITADEL Identity Platform\n- ZITADEL Chainguard Images\n- **ZITADEL**: >= 3.0.0-rc.1, < 3.4.12 (Fixed in: `3.4.12`)\n- **ZITADEL**: >= 4.0.0-rc.1, < 4.15.2 (Fixed in: `4.15.2`)\n\n## Mitigation\n\n- Upgrade ZITADEL instances to versions 3.4.12 or 4.15.2 or later.\n- Enforce mandatory 'exp' and 'iat' claims at the trusted external Identity Provider level.\n- Implement gateway-level validation rules to discard claims-deficient JSON Web Tokens.\n\n**Remediation Steps:**\n1. Identify all ZITADEL deployments utilizing external JWT identity federation.\n2. Apply the patch release 3.4.12 or 4.15.2 depending on the major version line.\n3. Verify the update by testing logins with tokens missing the expiration claim to ensure they are rejected.\n4. Audit active sessions for abnormally long survival times.\n\n## References\n\n- [GHSA-v77h-2w3m-94hx Security Advisory](https://github.com/zitadel/zitadel/security/advisories/GHSA-v77h-2w3m-94hx)\n- [NVD - CVE-2026-56665](https://nvd.nist.gov/vuln/detail/CVE-2026-56665)\n- [CVE Org Portal - CVE-2026-56665](https://www.cve.org/CVERecord?id=CVE-2026-56665)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56665) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T02:32:49.731166Z"}]}