The vulnerability sits in the GenericOpenIdConnectBackend of Zulip Server. The backend matches the identity provider's email claim to an account's delivery email without rejecting an explicitly false email_verified claim. If an attacker can make a trusted identity provider return an email address that the attacker does not own together with email_verified set to false, Zulip will authenticate the attacker as the existing account holder. This allows unauthorized access to that user’s data and therefore represents an authentication bypass (CWE‑287).

Zulip Server versions through 12.1 are affected. The issue does not apply to deployments that use an identity provider which only emits email addresses that the authenticating user controls. The fix was implemented in Zulip Server 12.2.

The CVSS score is 9.1, indicating high severity. The EPSS score is 0.0039, indicating a very low likelihood of exploitation, though the vulnerability is listed as not in the CISA KEV catalog. Exploitation requires a misconfigured trusted identity provider; an attacker cannot normally influence the email_verified flag from a compliant provider. Consequently, while the risk is high for affected installations, the attack surface is limited to entities that trust a provider capable of emitting unverified emails.