Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-84458 – Authentication Bypass / Account Takeover – Zammad < 7.1.2

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-84458 is a critical authentication bypass vulnerability in Zammad, an open-source web-based helpdesk and customer support system. The flaw resides in Zammad’s "Automatic account link on initial logon" SSO feature, which links an incoming third-party identity to an existing local account by matching email addresses without verifying that the identity provider actually confirmed ownership of that email. The vulnerability carries a CVSS score of 9.1 (Critical) and allows a remote, unauthenticated attacker to take over any account, including administrators.

Technical details

  • Root cause: when automatic account linking is enabled, Zammad binds an SSO identity to a local account solely on the basis of a matching email address, without confirming the identity provider verified that address.
  • For Microsoft 365 logins, Zammad relies on the xms_edov ID token claim to determine whether an email has been verified; if the claim is absent, Zammad is expected to treat the email as unverified, but the flawed logic does not correctly enforce this.
  • Trigger conditions: the "Automatic account link on initial logon" setting must be enabled. Exposure is heightened by Zammad’s default use of a multi-tenant Microsoft 365 app registration (/common), which allows an attacker to authenticate from any Azure AD tenant they control.
  • Attack vector: an attacker registers or controls an identity at a configured SSO provider, sets that identity’s email address to match a target victim’s email, and authenticates through SSO to Zammad.
  • Impact: the attacker is logged in as the victim, bypassing the victim’s local password entirely. This can affect any account, including agents and administrators, resulting in full account takeover and access to sensitive helpdesk data.

Affected software

  • Zammad versions <= 7.1.1
  • Fixed in Zammad 7.1.2

Severity

  • CVSS v4.0 Base Score: 9.1 (Critical)
  • Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Mitigation and recommended actions

  • Immediate: upgrade Zammad to version 7.1.2 or later.
  • If upgrading is not immediately possible: disable the "Automatic account link on initial logon" setting to prevent SSO identities from being auto-linked to existing local accounts based on unverified email matches.
  • Review SSO/Microsoft 365 login configuration and audit recent SSO logins for anomalies, particularly for administrator and agent accounts.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge