Authentication Rate-Limit Bypass in Zimbra Collaboration Suite by Zimbra
CVE-2026-93637

3.7LOW

Key Information:

Vendor

Zimbra

Status
Zimbra Collaboration Suite
Vendor
CVE Published:
14 October 2026

What is CVE-2026-93637?

An authentication rate-limit bypass vulnerability exists in Zimbra Collaboration Suite versions 10.1.0 to 10.1.21. This flaw allows unauthenticated attackers to exploit the GraphQL interface, enabling them to execute multiple password attempts in a single HTTP request without affecting the source-IP failure counter. Through the use of GraphQL aliases, attackers can circumvent the intended rate-limiting protections, potentially leading to unauthorized access to accounts.

Affected Version(s)

Zimbra Collaboration Suite 0 <= 10.1.21

References

https://www.rapid7.com/blog/post/ve-breaking-zimbra-ident...
third-party-advisory

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7
.