CVE-2026-104198

🗓️ 15 Oct 2026 19:48:52Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 36 Views🌐 WEB

Failed token handling in ZoneMinder web/includes/auth.php bypasses web authentication.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2026-104198	15 Oct 202619:55	–	circl
CNNVD	ZoneMinder authorization issue vulnerability	14 Oct 202616:00	–	cnnvd
Cvelist	CVE-2026-104198 ZoneMinder failed token handling bypasses web authentication	15 Oct 202619:48	–	cvelist
Debian CVE	CVE-2026-104198	15 Oct 202619:48	–	debiancve
EUVD	EUVD-2026-102423	15 Oct 202619:48	–	euvd
Mend	CVE-2026-104198	15 Oct 202619:48	–	mend
NVD	CVE-2026-104198	15 Oct 202620:17	–	nvd
osv_cve	CVE-2026-104198 ZoneMinder failed token handling bypasses web authentication	15 Oct 202619:48	–	osv_cve
osv_debian	DEBIAN-CVE-2026-104198	15 Oct 202620:17	–	osv_debian
osv_ubuntu	UBUNTU-CVE-2026-104198	16 Oct 202600:00	–	osv_ubuntu

Vulners

Node

zoneminder zoneminderRange1.34.0–1.36.63

[
  {
    "vendor": "ZoneMinder",
    "product": "zoneminder",
    "versions": [
      {
        "version": ">= 1.34.0, < 1.36.63",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/ZoneMinder/zoneminder/commit/95460a945ab7e5c63dc0551bdd6230a3026ceb9e
github	www.github.com/ZoneMinder/zoneminder/commit/6b94903e634fdb46cb71a48eadccf1aa14f0c2bb
github	www.github.com/ZoneMinder/zoneminder/security/advisories/GHSA-23fj-frfw-hmcr
github	www.github.com/ZoneMinder/zoneminder/commit/d71fbb805e4695a9599498a1a2ee3b286ef41c96
github	www.github.com/ZoneMinder/zoneminder/commit/71bb186b230dbe2aba5e2f804c36810aae892088
github	www.github.com/ZoneMinder/zoneminder/commit/144a04ca4fff5fd02745ce8afc239ba5e05cf8ac
github	www.github.com/ZoneMinder/zoneminder/commit/969baa38912018b502617d09e836d0bfa57d4af6

Parameter	Position	Path	Description	CWE
monitor_id	path	/zones	The zones view fails to properly validate the user session when a malformed token is provided, allowing unauthorized access to monitor and zone metadata via an attacker-selected monitor ID.	CWE-287, CWE-697

15 Oct 2026 21:17Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.3

EPSS0.00386

SSVC