PT-2025-16904 · Zulip · Zulip

Timabbott · Publicado 2025-04-16 · Atualizado 2026-01-23 · CVE-2025-31478

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zulip versions prior to 10.2

Description A bug in the Zulip server allows account creation without authenticating with the configured Single Sign-On (SSO) authentication backend in organizations where account creation is limited solely by SSO authentication and email/password authentication is disabled. This issue can be exploited to create an account without having an account with the configured SSO authentication backend.

Recommendations For versions prior to 10.2, update to version 10.2 to resolve the issue. As a temporary workaround, consider requiring invitations to join the organization to prevent the vulnerability from being accessed.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2025-31478

GHSA-QXFV-J6VG-5RQC

Produtos afetados

Zulip

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31478.json · Exploit
• https://github.com/zulip/zulip/security/advisories/GHSA-qxfv-j6vg-5rqc · Nota
• https://github.com/zulip/zulip/commit/b5ab90aaa4a7efdcbf886cb9e7d55fa5bfca3a28 · Nota
• https://twitter.com/CVEnew/status/1912722269383643644 · Publicação no Twitter
• https://t.me/cvetracker/21808 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-31478 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1912654297113690237 · Publicação no Twitter
• https://t.me/cvedetector/23203 · Publicação no Telegram
• https://t.me/cveNotify/149720 · Publicação no Telegram
• https://t.me/cveNotify/133637 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-31478 · Nota de Segurança