ZoneMinder Token Authentication Bypass in Web Interface

CVE-2026-104198

What is CVE-2026-104198?

ZoneMinder, an open-source closed-circuit television software, contains a vulnerability in its web interface that allows for bypassing token authentication. This issue arises from the mishandling of token states by the validateToken() function in web/includes/auth.php. When a malformed token is encountered, it incorrectly assigns a boolean false value to the global $user variable. Subsequent checks in web/index.php mistakenly interpret this as a logged-in user, thus skipping the necessary login redirect. This leads to unauthorized access to sensitive monitor and zone metadata via the zones view, as the system fails to enforce independent permission checks. The vulnerability has been addressed in version 1.36.63, implementing stronger validation measures to prevent unauthorized state changes.

References