CVE-2026-23933

Hardcoded session key in Zabbix 7.4

State: Published
Severity: 7.7 High
Published: Aug 18, 2026
Updated: Aug 19, 2026
Reserved: Jan 19, 2026

Description

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	Zabbix

Weaknesses

CWE-259 CWE-259: Use of Hard-coded Password

Affected Products

Product	Versions
ZabbixZabbix	7.4.0 through 7.4.10Affectedfrom 7.4.11Not affected

References

https://support.zabbix.com/browse/ZBX-28071

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.