CVE-2022-22785

CRITICAL 9.1CVE-2022-22785 · Published 18/05/2022 · updated 17/06/2026

In short

CVE-2022-22785 is a CRITICAL (CVSS 9.1) vulnerability affecting meetings (zoom).
Chance of exploitation in the next 30 days (EPSS): 3.5%, higher than 89.2% of all vulnerabilities.
Fix: update to 5.10.0 or later.

Package	Affected versions	Patched versions
meetings zoom	`< 5.10.0`	`5.10.0`

Description

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.

References

explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory

More vulnerabilities in meetings

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

meetings

zoom

< 5.10.0

5.10.0

Description

More vulnerabilities in meetings

See all →