CVE-2026-23933
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.
Risk Assessment
In specific configurations (SAML + guests), an attacker could forge sessions and gain unauthorized access to the Zabbix system, potentially compromising the security of monitored infrastructure.
Recommendation
It is recommended to review Zabbix configuration for SAML and guest usage and consider updating to a fixed version if available.
Original NVD description (English source)
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.