Critical Znuny flaw allows header-based login bypass in versions prior to 7.3.7

A critical authentication bypass vulnerability in Znuny ticketing software allows attackers to gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header, according to the National Vulnerability Database. The flaw, tracked as CVE-2026-93483, permits unauthenticated users to impersonate any existing user account, including those with administrative privileges, without providing valid credentials.

The National Vulnerability Database assigns a CVSS score of 9.5 to this issue, classifying it as Critical. The weakness stems from how Znuny processes authentication requests through its HTTPBasicAuth modules. Specifically, the application incorrectly trusts a user-controllable request header to determine the identity of the logged-in user. This design error allows an attacker to bypass standard login procedures entirely.

How the bypass works

The vulnerability exists within the HTTPBasicAuth modules for both the agent and customer interfaces in Znuny. These modules are responsible for reading the username during the login process. According to the NVD record, the software looks for the username in the $ENV{REMOTE_USER} variable, which is typically set by the web server after successful authentication. However, the application also checks a fallback variable, $ENV{HTTP_REMOTE_USER}, if the primary source is empty.

This fallback variable is populated directly from an attacker-controllable "Remote-User" HTTP request header. Because the application trusts this header without additional verification, an attacker can forge a request containing a specific username. When the system processes this request, it accepts the forged header as a valid authentication token. This allows the attacker to log in as the specified user without needing a password or other credentials.

Who is affected

The National Vulnerability Database states that Znuny versions before 6.5.25 and before 7.3.7 are affected by this vulnerability. The flaw is present only on systems where HTTPBasicAuth is configured as the authentication backend. If an organization uses a different authentication method, this specific bypass vector may not apply. However, any deployment relying on the HTTPBasicAuth module for agent or customer interfaces remains exposed to this attack.

The impact of a successful exploit is severe. An attacker who bypasses authentication gains full access to confidential data and system controls associated with the impersonated account. If an attacker impersonates an administrator, they obtain complete control over the Znuny instance. The NVD categorizes the underlying weakness as CWE-348, indicating an incorrect usage of authentication check functions.

What should you do?

Organizations using Znuny should immediately verify their current version against the list of affected releases. Administrators should audit their authentication backend configurations to determine if HTTPBasicAuth is enabled for any interfaces. If the vulnerable module is active, users should restrict access to the Znuny interface using network-level controls, such as firewalls or web application firewalls, to limit exposure to untrusted networks.