ZeroDay Findings
Sign inSign up

Findings

CVE-2022-23131

Zabbix Frontend Authentication Bypass Vulnerability

Published Jan 13, 2022 · updated Jun 16, 2026 · zabbix zabbix

In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).

Timeline

Detection, updates, and resolution for this record.

  1. Jan 13, 2022 · Catalog

    Detected

    In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor

  2. Feb 22, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 8, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor

Required action

Apply updates per vendor instructions.

CISA due date Mar 8, 2022

Affected

  • cpe zabbix/zabbixversion unspecified
  • cpe zabbix/zabbix6.0.0
  • vendor Zabbix Frontendversion unspecified

Sources

  • CISA KEVCVE-2022-23131

    Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.

    cisa.gov
  • CVE.orgCVE-2022-23131

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-23131

    30-day exploitation probability 95.7%

    first.org
  • NIST NVDCVE-2022-23131

    In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and g

    nvd.nist.gov

References