CVE-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
- Record
CVE-2022-23131- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-290
- Updated
- 2026-11-02
EUVDEUVD-2022-28222
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
- Record
EUVD-2022-28222- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4g73-3mxf-j47w
In the case of instances where the SAML SSO authentication is enabled (non-default), session data...
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
- Record
GHSA-4g73-3mxf-j47w- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-290
- Updated
- 2026-11-02
CISA KEV No score
Zabbix Frontend Authentication Bypass Vulnerability
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.
- Record
CVE-2022-23131- Weakness
- CWE-290
- Updated
- 2026-11-02
NVD
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
- Record
CVE-2022-23131- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-290
- Updated
- 2026-11-02
OSV
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
- Record
CVE-2022-23131- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 1mxml/CVE-2022-23131 | 2022-02-18 |
| PoC in GitHub | Mr-xn/cve-2022-23131 | 2022-02-18 |
| PoC in GitHub | jweny/CVE-2022-23131 | 2022-02-18 |
| PoC in GitHub | zwjjustdoit/cve-2022-23131 | 2022-02-21 |
| PoC in GitHub | L0ading-x/cve-2022-23131 | 2022-02-22 |
| PoC in GitHub | random-robbie/cve-2022-23131-exp | 2022-02-23 |
| PoC in GitHub | pykiller/CVE-2022-23131 | 2022-02-24 |
| PoC in GitHub | trganda/CVE-2022-23131 | 2022-02-24 |
| PoC in GitHub | Fa1c0n35/zabbix-cve-2022-23131 | 2022-02-27 |
| PoC in GitHub | kh4sh3i/CVE-2022-23131 | 2022-02-28 |
Show 11 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Kazaf6s/CVE-2022-23131 | 2022-04-02 |
| PoC in GitHub | SCAMagic/CVE-2022-23131poc-exp-zabbix- | 2022-07-22 |
| PoC in GitHub | Vulnmachines/Zabbix-CVE-2022-23131 | 2022-09-02 |
| PoC in GitHub | wr0x00/cve-2022-23131 | 2023-01-07 |
| PoC in GitHub | Arrnitage/CVE-2022-23131_exp | 2023-01-09 |
| PoC in GitHub | clearcdq/Zabbix-SAML-SSO-_CVE-2022-23131 | 2023-02-21 |
| PoC in GitHub | r10lab/CVE-2022-23131 | 2023-10-24 |
| PoC in GitHub | fork-bombed/CVE-2022-23131 | 2024-09-18 |
| PoC in GitHub | davidzzo23/CVE-2022-23131 | 2024-10-25 |
| PoC in GitHub | dagowda/Zabbix-cve-2022-23131-SSO-bypass | 2024-11-30 |
| Nuclei | Zabbix - SAML SSO Authentication Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23131 is a critical vulnerability (CVSS 9.1) in Dependencytrack Frontend, published January 13, 2022. CISA lists it as known to be exploited, since February 22, 2022. EUVD reports exploitation since February 22, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.7%, the 99th percentile. No source names a fixed version.