CVE-2026-104198
Deferred Deferred - Pending Action

ZoneMinder Authentication Bypass via Invalid Token Handling

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-104198
EUVD
EUVD-2026-102423

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ZoneMinder zoneminder >= 1.34.0, < 1.36.63

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ZoneMinder versions 1.34.0 through 1.36.38 have a flaw in the web interface where failed token authentication is mishandled. The validateToken() function returns false for invalid tokens, but this false value is assigned to the global $user variable. Since web/index.php checks isset($user), it treats false as a valid user, skipping login redirects and allowing access to views that should require authentication. This can expose monitor and zone metadata without proper permission checks.

Impact Analysis

An attacker could exploit this to access unauthorized views, such as the zones view, and view monitor and zone metadata without proper authentication. While unauthorized state changes are prevented due to permission helpers denying operations, sensitive information like monitor IDs and zone details may still be disclosed.

Mitigation Strategies

Upgrade ZoneMinder to version 1.36.63 or later to address the authentication bypass issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart