---
id: CVE-2026-104198
title: ZoneMinder failed token handling bypasses web authentication
summary: >-
  ZoneMinder is a free, open source closed-circuit television software
  application. In versions 1.34.0 through 1.36.38, the web interface mishandles
  failed token authentication in web/includes/auth.php. validateToken() returns
  false when a…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-287
  - CWE-697
vendor: ZoneMinder
product: zoneminder
affected:
  - 'zoneminder >= 1.34.0, < 1.36.63'
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T20:34:15.363799Z'
exploitAvailable: true
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T20:34:55.708Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104198'
references:
  - url: >-
      https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-23fj-frfw-hmcr
    label: >-
      https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-23fj-frfw-hmcr
  - url: >-
      https://github.com/ZoneMinder/zoneminder/commit/144a04ca4fff5fd02745ce8afc239ba5e05cf8ac
    label: >-
      https://github.com/ZoneMinder/zoneminder/commit/144a04ca4fff5fd02745ce8afc239ba5e05cf8ac
  - url: >-
      https://github.com/ZoneMinder/zoneminder/commit/6b94903e634fdb46cb71a48eadccf1aa14f0c2bb
    label: >-
      https://github.com/ZoneMinder/zoneminder/commit/6b94903e634fdb46cb71a48eadccf1aa14f0c2bb
  - url: >-
      https://github.com/ZoneMinder/zoneminder/commit/71bb186b230dbe2aba5e2f804c36810aae892088
    label: >-
      https://github.com/ZoneMinder/zoneminder/commit/71bb186b230dbe2aba5e2f804c36810aae892088
  - url: >-
      https://github.com/ZoneMinder/zoneminder/commit/95460a945ab7e5c63dc0551bdd6230a3026ceb9e
    label: >-
      https://github.com/ZoneMinder/zoneminder/commit/95460a945ab7e5c63dc0551bdd6230a3026ceb9e
  - url: >-
      https://github.com/ZoneMinder/zoneminder/commit/969baa38912018b502617d09e836d0bfa57d4af6
    label: >-
      https://github.com/ZoneMinder/zoneminder/commit/969baa38912018b502617d09e836d0bfa57d4af6
  - url: >-
      https://github.com/ZoneMinder/zoneminder/commit/d71fbb805e4695a9599498a1a2ee3b286ef41c96
    label: >-
      https://github.com/ZoneMinder/zoneminder/commit/d71fbb805e4695a9599498a1a2ee3b286ef41c96
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-15T20:29:40.569Z'
---

## Overview

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.

## Affected

- `zoneminder >= 1.34.0, < 1.36.63`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.