CVE-2026-104198 Details
Description
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.
An authentication bypass vulnerability has been identified in ZoneMinder versions 1.34.0 through 1.36.38 and in versions through 1.38.1. The issue arises in the web interface's token validation process, where malformed or invalid tokens are improperly handled. The 'validateToken()' function in 'web/includes/auth.php' returns false for invalid tokens, but this false value is incorrectly assigned to the global '$user' variable. Consequently, the authentication check in 'web/index.php' mistakenly treats '$user' as a valid user, bypassing the login redirect. This flaw allows unauthenticated access to views that require authentication, such as the zones view, which can disclose sensitive metadata without proper permission checks. Additionally, this vulnerability can lead to an unauthenticated denial-of-service condition by causing a PHP fatal error on the server.
Users can update to ZoneMinder version 1.36.63 or later, where this vulnerability has been fixed. Instructions for updating can be found in the ZoneMinder documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-697 | Incorrect Comparison | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZoneMinder | <= 1.38.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |