# CVE-2026-59788: Zabbix stored XSS in OAuth configuration form

Source: https://junglewise.ai/threats/cve-2026-59788-the-email-media-type-oauth-form-passes-the-authorization-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-59788 · Severity: info · Published 2026-10-05

Zabbix, a network monitoring and alerting platform, contains a cross-site scripting vulnerability in the email media type OAuth configuration form. An attacker can craft a malicious media type configuration file that, when imported by a Super Admin, executes arbitrary JavaScript in the admin's browser. This could lead to account compromise or unauthorized administrative actions.

Technologies: [Zabbix](https://junglewise.ai/threats/technologies/zabbix). Vendors: [Zabbix](https://junglewise.ai/threats/vendors/zabbix).

## Quick answers

**Is CVE-2026-59788 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59788 being exploited in the wild.

**How severe is CVE-2026-59788?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Zabbix 7.4.0 through 7.4.11.

**Is there a fix for CVE-2026-59788?** Yes: fixed in 7.4.12. Until then: Do not import media type configurations from untrusted sources until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59788 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-59788?** Check whether you run Zabbix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.4.12

Do not import media type configurations from untrusted sources until upgrading.

## Technical details

The OAuth form passes the Authorization endpoint URL directly to window.open() without validating the URL scheme, allowing javascript: URLs to be executed. The vulnerability is stored in the configuration and triggered when a Super Admin imports a crafted media type file and grants consent. An attacker with the ability to deliver the import file gains JavaScript execution in the context of the Super Admin's session.

## Affected products

- Zabbix Zabbix 7.4.0 through 7.4.11

## Timeline

- 2026-10-05: disclosed
- 2026-10-05: patched: Fixed in 7.4.12

## References

- [https://support.zabbix.com/browse/ZBX-28198](https://support.zabbix.com/browse/ZBX-28198)

## Related threats

- [Zabbix Frontend credential disclosure via search filtering](https://junglewise.ai/threats/cve-2026-59785-host-search-in-frontend-allows-filtering-by-fields-that-are-not)
- [Zabbix API PSK key extraction in host.get](https://junglewise.ai/threats/cve-2026-23937-zabbix-api-psk-key-extraction-in-host-get)
- [Zabbix Frontend denial of service via validate.api.exists](https://junglewise.ai/threats/cve-2026-23934-zabbix-frontend-denial-of-service-via-validate-api-exists)
- [Zabbix Frontend session key disclosure in database](https://junglewise.ai/threats/cve-2026-23933-zabbix-frontend-session-key-disclosure-in-database)
- [Zabbix Frontend plaintext macro value enumeration](https://junglewise.ai/threats/cve-2026-23931-zabbix-frontend-plaintext-macro-value-enumeration)