CVE-2026-23922

A flaw was found in Zabbix. A highly privileged user, such as a Super Admin, can exploit this vulnerability. By setting a malicious 'Token endpoint' in the email media OAuth configuration, the 'Client secret' can be leaked. This leads to information disclosure of sensitive credentials...

CVE-2026-23922

The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint...

CVE-2026-23922

Zabbix contains a vulnerability in the email media OAuth configuration where the 'Client secret' field cannot normally be read after saving. However, a Super Admin can disclose (and modify) the client secret by setting a malicious Token endpoint . The fix resets the client secret whenever the tok...