The vulnerability lies in Zabbix’s login lockout logic, where simultaneous failed login attempts are not properly tallied, enabling an attacker to exceed the intended guess limit. This flaw could allow an attacker to attempt more credential guesses than the lockout counter permits, potentially leading to a successful brute‑force or credential‑reuse attack. The weakness is a classic data race (CWE-362).

Zabbix Web Application, directly affecting all installations that rely on the Zabbix API or UI for authentication. No specific versions are listed in the CNA data, but affected releases include any that have not been updated to the fixed versions indicated by the vendor.

The CVSS score of 6.9 indicates moderate severity; the absence of an EPSS value means the exploitation probability is unknown, but the risk is not negligible. The vulnerability is not included in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is remote, through the HTTP API or frontend, where an attacker could send many concurrent login requests to subvert the lockout mechanism. If the application is exposed to the internet, the risk escalates due to the ease of automating concurrent attempts.