CVE-2026-105671

Zenitel Connect login allows username enumeration via verbose error responses

The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-105625

Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction

The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-105622

Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel

Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-105624

Zenitel Connect login allows account-lockout denial of service

The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-105623

Zenitel Connect web interface serves production JavaScript source maps without authentication

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-95613

Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim

The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-95615

Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API

OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-95614

Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container

The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect