CVE-2026-59563

HMAC Confirmation Token Unbinding in zscaler-mcp-server

State: Published
Severity: 4.6 Medium
Published: Sep 28, 2026
Updated: Sep 28, 2026
Reserved: Jul 6, 2026

Description

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.

Scores

CVSS	Score	Vector	Source
3.1	4.6 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L	Zscaler

Weaknesses

CWE-305 Authentication bypass by primary weakness

Affected Products

Product	Versions
zscaler-mcp-serverZscaler	0.7.0 to before 0.7.2Affected

References

https://github.com/zscaler/zscaler-mcp-server/pull/41

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.