This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-1199 →

DEBIAN-CVE-2026-1199

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counte...

Original description

The description as published by the source.

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 zabbix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 zabbix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 zabbix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.29+dfsg-1"}]}]

References

advisory security-tracker.debian.org