CVEvulnerability

CVE-2026-73576

6.5 MEDIUM Published 2026-08-13 Modified 2026-08-28 Official page ↗
Status
Analyzed
Published
2026-08-13
Last modified
2026-08-28
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1241

Description

In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with the generated secret may be able to recover the JWT signing secret through offline brute-force, potentially enabling JWT forgery.

Affected configurations

• synacor zimbra collaboration suite (< 10.1.17)

Related

Weakness · CWE (1)

  • CWE-1241 Use of Predictable Algorithm in Random Number Generator weakness

References