CVE-2022-22785: Improperly constrained session cookies in Zoom Client for Meetings

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-18 · updated 2026-06-17
Weakness: CWE-565

Description

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.

Affected products

Zoom Workplace: before 5.10.0 — fixed in 5.10.0

How to fix

Upgrade to a fixed version: Zoom Workplace 5.10.0. Check the vendor advisory for mitigations.

References

https://explore.zoom.us/en/trust/security/security-bulletin
https://explore.zoom.us/en/trust/security/security-bulletin

Get alerted when CVE-2022-22785 or the next vulnerability affects your stack