Authentication bypass using an alternate path or channel in Zulip Server - #VU162564
Published: November 9, 2026
Vulnerability details
The vulnerability allows a remote user to bypass an organization's single sign-on requirement and create and access an account without using its configured external authentication methods.
The vulnerability exists due to an authentication bypass in HomepageForm.clean_email in zerver/forms.py when processing sign-up requests from reusable invitation links in organizations with only external authentication enabled. A remote user can submit a controlled email address permitted by the organization to /join/<key>/ using a valid reusable invitation link, then follow the emailed confirmation link to create an account and log in without completing single sign-on.
The resulting account has the role and channel subscriptions specified by the invitation link.