Authorization bypass through user-controlled key in ZoneMinder - #VU158963
Published: November 3, 2026
Vulnerability identifier: #VU158963
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges to administrator, disclose sensitive information, modify configuration and user accounts, and stop monitoring.
The vulnerability exists due to authorization bypass through a user-controlled token subject in ZoneMinder's /api/host/login endpoint when issuing JWTs without checking that the requested subject matches the authenticated identity. A remote user can submit user=admin&username=sysview&password=sysviewpass using their own enabled, API-enabled account credentials and omitting the pass parameter to obtain valid administrator access and refresh tokens, then access protected administrative functions.
Affected software
ZoneMinder
Remediation
Install security update from vendor's website.
ZoneMinder - update to 1.38.5