CVE-2026-23933: Zabbix 7.4 Authentication Bypass Vulnerability

CVE-2026-23933 Overview

CVE-2026-23933 affects Zabbix 7.4, where the cryptographic key used to sign Frontend sessions was mistakenly written to the database seed. An attacker with access to the seed can reuse the key to forge valid session cookies. The vulnerability is exploitable only in deployments that combine Security Assertion Markup Language (SAML) authentication with guest users enabled. Other Zabbix configurations have no known impact. The issue maps to CWE-259: Use of Hard-coded Password and requires adjacent network access.

Critical Impact
Attackers can forge signed Frontend session cookies and obtain unauthorized access to Zabbix when SAML authentication and guest users are both enabled.

Affected Products

Zabbix 7.4
Zabbix Frontend deployments using SAML authentication
Zabbix instances with guest user access enabled

Discovery Timeline

2026-08-18 - CVE-2026-23933 published to the National Vulnerability Database (NVD)
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-23933

Vulnerability Analysis

Zabbix Frontend signs session cookies using a cryptographic key intended to remain server-side and secret. In Zabbix 7.4, the build process wrote this signing key into the database seed shipped with the product. Any party that inspects the seed learns a key that should have been unique and confidential per deployment. Once the key is known, an attacker can craft session cookies that the Frontend accepts as legitimate.

Exploitation requires two additional conditions. First, the deployment must use SAML authentication for single sign-on. Second, guest users must be enabled on the Frontend. When both conditions hold, forged cookies can map to a valid guest session and subsequently escalate through SAML flow assumptions in the session handler. Deployments outside this configuration are not known to be exploitable.

Root Cause

The root cause is a build-time secret leak. The signing key was hard-coded into the database seed rather than generated per installation. This pattern falls under CWE-259: Use of Hard-coded Password, where a secret intended to be unique becomes shared across all installations that consume the seed.

Attack Vector

The attack vector is Adjacent Network. An attacker on a network position where they can reach the Zabbix Frontend uses the leaked key to sign a session cookie for a guest identity. They present the cookie to the Frontend, which validates the signature against the same leaked key. Because SAML authentication is enabled alongside guest access, the forged session is accepted without a live SAML assertion. Refer to the Zabbix Issue ZBX-28071 advisory for vendor-provided technical detail.

Detection Methods for CVE-2026-23933

Indicators of Compromise

Unexpected guest or SAML-linked sessions on the Zabbix Frontend originating from unfamiliar source addresses.
Frontend audit log entries showing session activity without a corresponding SAML assertion in the identity provider (IdP) logs.
Session cookies presenting valid signatures but referencing user identifiers not created through the normal onboarding flow.

Detection Strategies

Correlate Zabbix Frontend access logs with SAML IdP logs and flag sessions that lack a matching authentication event.
Alert on any successful Frontend access using the guest user when SAML is the configured authentication method.
Baseline the source networks that legitimately access the Zabbix Frontend and alert on deviations.

Monitoring Recommendations

Enable verbose Frontend audit logging and forward it to a central log platform for correlation with IdP telemetry.
Monitor for administrative configuration changes that enable or re-enable the guest user after remediation.
Track outbound actions initiated by guest sessions, including host or item queries that expose infrastructure inventory.

How to Mitigate CVE-2026-23933

Immediate Actions Required

Disable the guest user on any Zabbix 7.4 Frontend that uses SAML authentication until patched.
Rotate the Frontend session signing key after upgrading, invalidating any previously issued cookies.
Restrict network reachability to the Zabbix Frontend to trusted management networks.

Patch Information

Consult the Zabbix Issue ZBX-28071 tracker for the fixed release and upgrade guidance. Apply the vendor-supplied update to a Zabbix version that regenerates the session signing key at installation rather than sourcing it from the database seed. After patching, force logout of existing sessions and verify that the key stored in configuration is unique to the deployment.

Workarounds

Disable SAML authentication on the Frontend if guest access is required for operational reasons.
Disable the guest user account across all user groups if SAML must remain enabled.
Place the Zabbix Frontend behind a reverse proxy or VPN that enforces authenticated access before requests reach the application.

bash

# Disable the Zabbix guest user via the API (example)
# Requires an authenticated admin token; adjust host and token accordingly
curl -X POST -H 'Content-Type: application/json-rpc' \
  -d '{
    "jsonrpc": "2.0",
    "method": "user.update",
    "params": {"userid": "2", "usrgrps": [{"usrgrpid": "9"}]},
    "auth": "<admin-token>",
    "id": 1
  }' \
  https://zabbix.example.com/api_jsonrpc.php