CVE-2026-104198

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.34.0 through 1.36.38

Description The web interface mishandles failed token authentication in the web/includes/auth.php file. The validateToken() function returns false when a token is malformed or has an invalid signature, but this value is assigned to the global $user variable. Because web/index.php checks for the existence of the user using isset($user), the boolean false value is treated as a present user, allowing the login redirect to be skipped. This allows access to views that rely on the outer authentication gate, such as the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check.

Recommendations Update ZoneMinder to version 1.36.63.