CVE-2026-93637: Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Zimbra Collaboration Suite versions 10.1.0 through 10.1.21 are affected. The bypass is reachable by unauthenticated attackers over the network.
What does an attacker need to exploit this?
No account, prior authentication, or user interaction is required. Exploitation requires sending password guesses through GraphQL and using aliases to batch multiple authentication attempts into a single HTTP request.
Why does rate limiting not stop these attempts?
Authentication attempts made through the affected GraphQL batching mechanism do not increment Zimbra's source-IP failure counter. As a result, repeated password guesses can avoid the pre-authentication rate limit tied to that counter.