CVE-2026-73576
- State
- Published
- Severity
- 6.3 Medium
- Published
- Aug 13, 2026
- Updated
- Aug 13, 2026
- Reserved
- Aug 12, 2026
Description
In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with the generated secret may be able to recover the JWT signing secret through offline brute-force, potentially enabling JWT forgery.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N | mitre |
Weaknesses
- CWE-1241 Use of Predictable Algorithm in Random Number Generator
Affected Products
| Product | Versions |
|---|---|
CollaborationZimbra |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.