CVE-2022-23131VulnerabilityPublished 02/22/2022Updated 10/24/2026

CVE-2022-23131: Zabbix Frontend Authentication Bypass Vulnerability

Affects Zabbix FrontendSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 02/22/2022
KEV deadline: 03/08/2022
EPSS: 95.7% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2022-23131 (opens in a new tab)

Description

CVE-2022-23131 is a high-severity vulnerability in the Zabbix Frontend that allows authentication bypass due to unsafe client-side session storage when SAML is configured. This flaw can lead to unauthorized access or takeover of the Zabbix instance. Exploitation of this vulnerability has been observed in the wild.

Summary

CVE-2022-23131 is an authentication bypass vulnerability in the Zabbix Frontend component. The issue arises from unsafe client-side session storage mechanisms when SAML authentication is configured, enabling attackers to bypass authentication controls and potentially take over the affected Zabbix instance. This vulnerability is tracked under CWE-290 (Authentication Bypass) and has been exploited in the wild.

Impact

Successful exploitation allows an attacker to bypass authentication protections on the Zabbix Frontend, potentially gaining unauthorized access and control over the Zabbix monitoring instance. This could lead to compromise of monitoring data and administrative functions.

Mitigation

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should monitor vendor communications closely and consider restricting access to the Zabbix Frontend, especially if SAML authentication is enabled.

Weaknesses

CWE-290Unclassified weakness (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:11:53 UTC

Weaknesses

References

Related threats