Search vulnerabilities

Results 1

Export CSV
CVE-2026-59563

HMAC Confirmation Token Unbinding in zscaler-mcp-server

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors