CVE-2026-104198Published
ZoneMinder failed token handling bypasses web authentication
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-104198 · Microsoft / collected KEV context
cve-program · CVE-2026-104198
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-23fj-frfw-hmcr
- https://github.com/ZoneMinder/zoneminder/commit/144a04ca4fff5fd02745ce8afc239ba5e05cf8ac
- https://github.com/ZoneMinder/zoneminder/commit/6b94903e634fdb46cb71a48eadccf1aa14f0c2bb
- https://github.com/ZoneMinder/zoneminder/commit/71bb186b230dbe2aba5e2f804c36810aae892088
- https://github.com/ZoneMinder/zoneminder/commit/95460a945ab7e5c63dc0551bdd6230a3026ceb9e
- https://github.com/ZoneMinder/zoneminder/commit/969baa38912018b502617d09e836d0bfa57d4af6
- https://github.com/ZoneMinder/zoneminder/commit/d71fbb805e4695a9599498a1a2ee3b286ef41c96
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.