OAuth Vulnerability in Zabbix Affects Client Secret Storage
CVE-2026-23922

2.1LOW

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
18 August 2026

What is CVE-2026-23922?

A security issue in Zabbix's OAuth implementation allows a Super Admin to potentially expose the 'Client secret' associated with the email media type. This exposure can occur when the Token endpoint is set to a malicious value, permitting unauthorized access to sensitive information. To mitigate this risk, the system resets the client secret whenever the token endpoint is altered, reinforcing security measures.

Affected Version(s)

Zabbix 7.4.0 <= 7.4.8

References

https://support.zabbix.com/browse/ZBX-28067

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank sebiee for submitting this report on the HackerOne bug bounty platform.
.