CVE-2026-34721

MediumCVSS 6.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

CSRF vulnerability in Zammad prior to 7.0.1 and 6.5.4. OAuth callback endpoints for Microsoft, Google, and Facebook do not validate a CSRF state parameter.

Risk Assessment

An attacker can exploit the missing validation to perform unauthorized actions on behalf of an authenticated user, such as linking fake accounts.

Recommendation

Update Zammad to version 7.0.1 or 6.5.4 where state parameter validation is added.

Original NVD description (English source)

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This vulnerability is fixed in 7.0.1 and 6.5.4.