CVE-2026-1199 — API and Frontend login lockout race condition

CVE-2026-1199

API and Frontend login lockout race condition PUBLISHED

Description (CNA)

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 6.0.0 through 6.0.46; affected 7.0.0 through 7.0.27; affected 7.4.0 through 7.4.11

CWE

CWE-362

References

https://support.zabbix.com/browse/ZBX-28076

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.