Zimbra Collaboration Suite 10.1.0-10.1.21 GQL Auth Rate-Limit Bypass
CVE-2026-93637 Published on October 14, 2026

Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbras source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.

NVD

Vulnerability Analysis

CVE-2026-93637 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Improper Restriction of Excessive Authentication Attempts

The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.


Products Associated with CVE-2026-93637

Want to know whenever a new CVE is published for Zimbra Collaboration Suite? stack.watch will email you.

Zimbra Collaboration Suite
 

Affected Versions

Zimbra Collaboration Suite: