CVE-2022-23131: Zabbix Frontend SAML SSO authentication bypass via session spoofing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing and near-maximum EPSS make this an actively exploited, remotely reachable authentication bypass.

What it is

Zabbix Frontend fails to verify the user login stored in the session when SAML SSO authentication is enabled, allowing session data to be modified. An unauthenticated attacker who knows a valid Zabbix username (or the guest account, disabled by default) can bypass authentication and escalate to admin. The flaw only applies to non-default configurations where SAML SSO is turned on.

Impact

An attacker gains full administrative access to the Zabbix Frontend, exposing monitoring configuration, host data and credentials, and enabling further compromise of monitored infrastructure.

Attack surface

Reachable over the network against the Zabbix Frontend web interface with no authentication and no user interaction, but only when SAML SSO authentication is enabled and the attacker knows a valid username.

Exploitation

Listed in CISA KEV since 2022-02-22 with a required action deadline of 2022-03-08, and EPSS probability is 0.95683 (99.868th percentile), indicating active exploitation in the wild. No ransomware campaign use is documented.

What to do

• Apply the vendor patch referenced in ZBX-20350 for the affected Zabbix Frontend versions.
• If SAML SSO is not required, disable it to remove the vulnerable code path.
• Restrict network access to the Zabbix Frontend to trusted management networks.
• Disable or rename the guest account and avoid predictable usernames.
• Rotate Zabbix admin credentials and review accounts for unauthorized additions.

Detection

• Review Zabbix Frontend and web server logs for authentication or session anomalies, especially logins without a preceding SAML assertion.
• Audit Zabbix user and role changes, new admin accounts, and configuration edits for unexpected activity.
• Hunt for requests to the Zabbix Frontend from unusual source IPs or user agents, particularly outside normal admin networks.
• Correlate SAML identity provider logs against Zabbix session creation to find sessions with no matching assertion.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.