Authentication Bypass by Spoofing in ZoneMinder - #VU158967
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication token IP-binding protection and disclose sensitive information using a stolen token.
The vulnerability exists due to unconditional trust in the client-supplied X-Forwarded-For header in ZoneMinder's includes/session.php and includes/auth.php when generating and validating hashed authentication tokens with ZM_AUTH_HASH_IPS enabled. A remote attacker can replay a stolen, still-valid auth token while setting X-Forwarded-For to its originally bound IP address to bypass the IP restriction and access sensitive information from a different location.
Exploitation is restricted to deployments exposed directly or behind a reverse proxy that preserves client-supplied X-Forwarded-For values.