CVE-2016-20030CWE-551

ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction

Critical · published March 15, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00573 · 46.3th percentile
Weakness
CWE-551 · Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Published
2026-03-15T13:35Z
EPSS history
Timeline
  • 15 MAR 13:35Z
    ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction
    cvelistv5