Authentication Bypass in Zenitel Connect

CVE-2026-105622

What is CVE-2026-105622?

A vulnerability in Zenitel Connect prior to version 1.11.0 allows remote attackers to bypass authentication mechanisms through unlimited attempts at guessing user passwords. This occurs due to a failure in implementing account lockout or rate limiting within the WAMP-CRA authentication path. Although the affected system enforces a robust password policy, the lack of restrictions means that attackers could exploit reused or easily predictable passwords, compromising user accounts. The vulnerability has been addressed in version 1.11.0, where the problematic authentication path has been removed.

References