Description
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.
Published: 2026-10-15
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass
Action: Immediate Patch
AI Analysis

Impact

A flaw in the authentication routine causes the system to treat a failed token check as a legitimate user login, allowing an unauthenticated attacker to dispatch restricted views and view monitor and zone metadata. The vulnerability does not grant elevated privileges or enable state changes, but it exposes sensitive configuration details that could be leveraged in further attacks or inform a future exploitation vector.

Affected Systems

ZoneMinder versions 1.34.0 through 1.36.38 are affected; the fix is applied in 1.36.63 and later.

Risk and Exploitability

The CVSS score of 5.3 denotes a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only a crafted HTTP request to the web interface and is therefore remotely feasible, though the impact is limited to information disclosure rather than direct system compromise.

Generated by OpenCVE AI on October 16, 2026 at 16:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to ZoneMinder version 1.36.63 or later, where token validation properly rejects malformed tokens before applying any user context.
  • If an upgrade is not possible, modify or replace the validateToken() function so that on failure the global user variable is unset and the authentication gate rejects the request.
  • As an interim measure, deploy a web application firewall rule to block requests containing malformed or invalid authentication tokens to mitigate the bypass.

Generated by OpenCVE AI on October 16, 2026 at 16:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
First Time appeared Zoneminder
Zoneminder zoneminder
Vendors & Products Zoneminder
Zoneminder zoneminder

Thu, 15 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Description ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.
Title ZoneMinder failed token handling bypasses web authentication
Weaknesses CWE-287
CWE-697
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Zoneminder Zoneminder
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-15T20:34:55.708Z

Reserved: 2026-10-01T18:54:15.119Z

Link: CVE-2026-104198

cve-icon Vulnrichment

Updated: 2026-10-15T20:34:48.830Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T20:17:06.127

Modified: 2026-10-15T21:17:02.680

Link: CVE-2026-104198

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T04:00:03Z

Weaknesses