Auth bypass in Zulip
CVE-2025-31478
Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a single-sign on authentication backend, meaning the organization places no restrictions on email address domains or invitations being required to join, but has disabled the EmailAuthBackend that is used for email/password authentication. A bug in the Zulip server means that it is possible to create an account in such organizations, without having an account with the configured SSO authentication backend. This issue is patched in version 10.2. A workaround includes requiring invitations to join the organization prevents the vulnerability from being accessed.
Vulnerability class: Broken Authentication
EPSS: 0.003 (26.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Zulip — versions < 10.2
- Zulip Zulip_server
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-31478?
- CVE-2025-31478 is a high-severity vulnerability in Zulip, classified under Improper Authentication. CVSS score: 8.2/10. Published 2025-04-16.
- How severe is CVE-2025-31478?
- High severity. CVSS v3 base score is 8.2 out of 10.