CVE-2026-34720

MediumCVSS 4.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

SSO mechanism vulnerability in Zammad prior to 7.0.1 and 6.5.4. The system did not verify the header originates from a trusted SSO proxy/gateway before applying actions.

Risk Assessment

An attacker can impersonate a trusted proxy and gain unauthorized access to user accounts, bypassing authentication.

Recommendation

Update Zammad to version 7.0.1 or 6.5.4 where header origin verification is added.

Original NVD description (English source)

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fixed in 7.0.1 and 6.5.4.