CVE-2026-104198

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.

• CWE-287
• CWE-697

• https://github.com/ZoneMinder/zoneminder/commit/144a04ca4fff5fd02745ce8afc239ba5e05cf8ac
• https://github.com/ZoneMinder/zoneminder/commit/6b94903e634fdb46cb71a48eadccf1aa14f0c2bb
• https://github.com/ZoneMinder/zoneminder/commit/71bb186b230dbe2aba5e2f804c36810aae892088
• https://github.com/ZoneMinder/zoneminder/commit/95460a945ab7e5c63dc0551bdd6230a3026ceb9e
• https://github.com/ZoneMinder/zoneminder/commit/969baa38912018b502617d09e836d0bfa57d4af6
• https://github.com/ZoneMinder/zoneminder/commit/d71fbb805e4695a9599498a1a2ee3b286ef41c96
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-23fj-frfw-hmcr

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104150AdonisJS HTTP Server is a package for handling HTTP requests…8.7
• CVE-2026-104181Filament is a collection of full-stack components for accele…5.4
• CVE-2026-104182stream-json is a micro-library of stream components for proc…6.2
• CVE-2026-104183stream-json is a micro-library of stream components for proc…5.1
• CVE-2026-104189The 3D Viewer for Nextcloud is a comprehensive 3D model view…7.5
• CVE-2026-104192Dragonfly is an in-memory data store built for modern applic…9.6
• CVE-2026-1042The WP Hello Bar plugin for WordPress is vulnerable to Store…4.4
• CVE-2026-10420Untrusted pointer dereference vulnerability in Samsung Open …5.5
• CVE-2026-104246The Contact Form 7 Signature Addon WordPress plugin through …5.9
• CVE-2026-104250The unstructured library provides open-source components for…6.1
• CVE-2026-104252Vitess is a database clustering system for horizontal scalin…9.8
• CVE-2026-104266tinytag is a Python library for reading audio file metadata.…6.5