{"id":"CVE-2022-23131","published":"2022-01-13T16:15:08Z","modified":"2026-06-17T04:29:34Z","title":"Zabbix Frontend Authentication Bypass Vulnerability","vendor":"Zabbix","product":"Frontend","tier":"core","eol":null,"description":{"text":"In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).","provenance":"source","from":"NVD"},"summary":{"text":"The Zabbix Frontend contains an authentication bypass flaw in its SAML SSO authentication path, where a user login stored in session data is not verified and can therefore be modified. An unauthenticated remote attacker can exploit this when SAML authentication is enabled (a non-default setting) and they know a Zabbix username, or use the guest account if it has been enabled, to escalate privileges and gain admin access.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:49Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.95683,"percentile":0.9987,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-02-22","dueDate":"2022-03-08","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-23131","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-02-22","exploitedFirstSeen":"2022-02-22","ransomware":false,"evidence":[{"url":"https://cert.gov.ua/article/37287","date":"2022-02-22"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-02-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-21&host_type=src&vulnerability=cve-2022-23131","date":"2026-09-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-22&host_type=src&vulnerability=cve-2022-23131","date":"2026-09-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-25&host_type=src&vulnerability=cve-2022-23131","date":"2026-09-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-26&host_type=src&vulnerability=cve-2022-23131","date":"2026-09-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-27&host_type=src&vulnerability=cve-2022-23131","date":"2026-09-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-28&host_type=src&vulnerability=cve-2022-23131","date":"2026-09-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2022-23131","date":"2026-09-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2022-23131","date":"2026-10-02"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-290","name":"Authentication Bypass by Spoofing"}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-20350","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://support.zabbix.com/browse/ZBX-20350","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23131","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default \"Admin\" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers. ","confidence":"high"},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default \"Admin\" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers. ","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default \"Admin\" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers. ","confidence":"high"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default \"Admin\" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-28222","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28222","exploited":true,"exploitedSince":"2022-02-22","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":18,"skipped":2,"earliest":"2022-02-18","earliestUrl":"https://github.com/jweny/CVE-2022-23131","repos":[{"name":"Mr-xn/cve-2022-23131","url":"https://github.com/Mr-xn/cve-2022-23131","stars":155,"created":"2022-02-18"},{"name":"jweny/CVE-2022-23131","url":"https://github.com/jweny/CVE-2022-23131","stars":95,"created":"2022-02-18"},{"name":"L0ading-x/cve-2022-23131","url":"https://github.com/L0ading-x/cve-2022-23131","stars":29,"created":"2022-02-22"},{"name":"kh4sh3i/CVE-2022-23131","url":"https://github.com/kh4sh3i/CVE-2022-23131","stars":15,"created":"2022-02-28"},{"name":"Kazaf6s/CVE-2022-23131","url":"https://github.com/Kazaf6s/CVE-2022-23131","stars":11,"created":"2022-04-02"}]},"nuclei":[{"id":"CVE-2022-23131","name":"Zabbix - SAML SSO Authentication Bypass","severity":"critical","path":"http/cves/2022/CVE-2022-23131.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23131.yaml"}],"first":{"date":"2022-02-18","source":"PoC-in-GitHub","url":"https://github.com/jweny/CVE-2022-23131"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1548"],"provenance":"source"},{"stage":"secondary","techniques":["T1078","T1059"],"provenance":"source"}],"timeline":[{"date":"2022-01-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23131","provenance":"source"},{"date":"2022-02-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/jweny/CVE-2022-23131","provenance":"source"},{"date":"2022-02-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cert.gov.ua/article/37287","provenance":"source"},{"date":"2022-02-22","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-02-22","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28222","provenance":"source"}],"speed":{"daysToPublicExploit":36,"firstExploitFrom":"PoC-in-GitHub","daysToKev":40},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1710 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"18 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}