CVE-2026-93637 — Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting

CVE-2026-93637

Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting PUBLISHED

Description (CNA)

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.

Affected (CNA)

Vendor / product	Versions
Zimbra / Zimbra Collaboration Suite	affected 0 through 10.1.21

CWE

CWE-307

References

https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.