Authorization Bypass Vulnerability in ZKTeco BioTime Biometric Data Endpoint
CVE-2026-108796

5.3MEDIUM

Key Information:

Vendor

Zkteco

Status
Biotime
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108796?

A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 that allows for an authorization bypass via the biometric data endpoint. By manipulating the 'emp_code' argument, an attacker can gain unauthorized access to sensitive biometric data. This attack can be executed remotely, making it a significant concern for users of the product. Efforts to notify the vendor about this issue have not received a response.

Affected Version(s)

BioTime 9.5.6 Build 20260130.3206

References

https://vuldb.com/vuln/416573
vdb-entrytechnical-description
https://vuldb.com/vuln/416573/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108796
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bashdar (VulDB User)
VulDB CNA Team
.