Zabbix email media OAuth configuration allows a Super Admin to expose the client secret by setting a malicious token endpoint. After the client secret is entered and saved, it is normally not retrievable, but the vulnerability permits a privileged user to redirect the token retrieval process to an attacker‑controlled server, thus leaking the secret. This could enable credential theft and unauthorized OAuth token usage, representing a loss of confidentiality for the integration.

The affected product is Zabbix, specifically the email media OAuth configuration. No version range is provided in the advisory, so any deployment that uses the email media OAuth feature should be evaluated for applicability.

The CVSS score of 2.1 indicates a low overall impact, and the issue is not listed in the CISA KEV catalog. The likelihood of exploitation relies on a Super Admin having the ability to change the token endpoint. Because the attacker must be a privileged administrator, the opportunity for external attackers is limited. The EPSS score is not available, but the vulnerability remains a concern for internal threat actors with administrative access.