CVE-2016-20030 CRITICAL

CVE-2016-20030: ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction

Vendor Zkteco Inc.

Product ZKTeco ZKBioSecurity

Weakness CWE-551

Published March 15, 2026

Last update June 8, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.

Key dates

02Disclosure timeline

March 15, 2026 CVE published

June 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2016-20030 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/551.html

Related vulnerabilities

04Related CVE

CVE-2021-32779 Incorrectly handling of URI '#fragment' element as part of the path element CVE-2026-4636 Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. CVE-2026-0707 Keycloak: keycloak authorization header parsing leading to potential security control bypass CVE-2023-23924 URI validation failure on SVG parsing in Dompdf CVE-2021-32777 Incorrect concatenation of multiple value request headers in ext-authz extension