Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block… (CVE-2026-1199)

The vulnerability in Zabbix's API and frontend login lockout mechanism involves improper counting of simultaneous unsuccessful login requests towards the block counter. This flaw can allow attackers to bypass the intended lockout restrictions by sending multiple login attempts concurrently, thus increasing the number of password guesses allowed. The CVSS score of 3.7 reflects a network attack vector with high attack complexity, no privileges required, no user interaction, and limited impact on integrity only. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

The impact is limited to a potential increase in the number of password guesses an attacker can make before lockout occurs, which may reduce the effectiveness of the login lockout mechanism. This could facilitate brute force or password guessing attempts but does not directly affect confidentiality or availability. The medium severity rating reflects this limited impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional protective measures such as external rate limiting or multi-factor authentication to reduce the risk of password guessing attacks. Monitor vendor channels for updates and apply official patches once released.