CVE-2026-1199: API and Frontend login lockout race condition
Published Aug 18, 2026
·Updated
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.
Affected Software
1 affected component
Zabbix
Event History
Aug 18, 2026
CVE Published
via MITRE·12:15 PM
Data Sourced
via MITRE·12:15 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What does an attacker need to do to take advantage of this issue?
An attacker needs to send multiple unsuccessful login requests at the same time. Under those conditions, some failed attempts may not be counted toward the lockout counter, allowing more password guesses than the configured mechanism is intended to permit.