EUVD-2026-60731
GHSA-wx93-p8qg-2gp4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Super Admin access required (PR:H); only a single OAuth credential exposed (C:L); no integrity or availability impact; scope unchanged.
Primary rating from Vendor (Zabbix).
CVSS VectorVendor: Zabbix
Lifecycle Timeline
1DescriptionCVE.org
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.
AnalysisAI
OAuth client secret exposure in Zabbix email media configuration allows a Super Admin to exfiltrate the stored client secret by pointing the Token endpoint to an attacker-controlled server. Because the secret is masked in the UI after saving but still transmitted when OAuth token requests are made, changing the endpoint URL effectively redirects the credential to an external host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Super Admin privileges within Zabbix - the highest privilege level in the platform. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk of this vulnerability is very low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The vendor has implemented a fix that automatically resets the OAuth Client Secret when the Token endpoint URL is changed, preventing the leakage path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQ
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. Rated hi
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x bef
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addre
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. Rated critical severity
Zabbix server can perform command execution for configured scripts. Rated high severity (CVSS 8.8), this vulnerability i
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, a
Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execu
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resul
Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. Rated critical s
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today