LOW
Zammad has an origin validation error in SSO mechanism
Published Apr 8, 2026
2.3
LOWCVSS 4.0
EPSS 0.14%
Description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fixed in 7.0.1 and 6.5.4.
Affected products
-
Affected
- < 6.5.4
- ≥ 7.0.0-alpha, < 7.0.1
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20560 Advisory
- https://github.com/zammad/zammad/security/advisories/GHSA-hcv6-w4h9-p2p7 x_refsource_CONFIRMVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20560 | Advisory | |
| https://github.com/zammad/zammad/security/advisories/GHSA-hcv6-w4h9-p2p7 | x_refsource_CONFIRMVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Apr 8, 2026
Updated Apr 9, 2026
Reserved Mar 30, 2026
Link CVE-2026-34720
CISA Vulnrichment
Updated Apr 9, 2026
Red Hat
No data
GitHub
No data