CVE-2026-93483: Znuny Authentication Bypass Vulnerability

CVE-2026-93483 Overview

CVE-2026-93483 is an authentication bypass vulnerability in Znuny through version 7.3.6. The flaw exists in the Kernel::System::Auth::HTTPBasicAuth and Kernel::System::CustomerAuth::HTTPBasicAuth modules. These modules trust the HTTP_REMOTE_USER environment variable, which maps directly to the attacker-controllable Remote-User HTTP request header. When HTTPBasicAuth is configured as the authentication backend, an unauthenticated attacker can impersonate any user, including administrators, by sending a single HTTP request with a forged header. No credentials are required. The vulnerability is classified under [CWE-348] (Use of Less Trusted Source).

Critical Impact

Unauthenticated attackers can log in as any existing agent or customer, including administrators, gaining full access to confidential ticket data and system controls.

Affected Products

• Znuny versions through 7.3.6
• Znuny agent interface with Kernel::System::Auth::HTTPBasicAuth backend
• Znuny customer interface with Kernel::System::CustomerAuth::HTTPBasicAuth backend

Discovery Timeline

• 2026-10-15 - CVE-2026-93483 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-93483

Vulnerability Analysis

Znuny's HTTPBasicAuth modules are designed to delegate authentication to the web server. After the web server validates credentials, it sets the REMOTE_USER CGI environment variable. Znuny then reads that value and establishes a session for the named user.

The flaw stems from a fallback path. If $ENV{REMOTE_USER} is empty, the module reads $ENV{HTTP_REMOTE_USER} instead. Per CGI conventions, any HTTP request header is exposed as an HTTP_* environment variable. A client-supplied Remote-User: header therefore populates HTTP_REMOTE_USER directly.

Because the fallback is unconditional, the application treats attacker-controlled input as if it came from a trusted authentication layer. The resulting session carries the full privileges of the impersonated account.

Root Cause

The root cause is misplaced trust in a client-controlled input source. The code does not distinguish between REMOTE_USER, which only the web server can set, and HTTP_REMOTE_USER, which any HTTP client can set by adding a header. CWE-348 describes this exact pattern: use of a less trusted source for a security decision.

Attack Vector

Exploitation requires no authentication, no user interaction, and no prior access. An attacker sends an HTTP request to the Znuny agent or customer interface and includes a Remote-User header set to a known username such as root@localhost or an administrator login. Znuny parses the header value, locates the matching account, and issues a valid session. The attacker then operates with that user's permissions, including reading tickets, modifying configuration, and creating additional accounts.

See the Znuny Advisory ZSA-2026-14 for vendor technical details.

Detection Methods for CVE-2026-93483

Indicators of Compromise

• Inbound HTTP requests containing a Remote-User request header directed at Znuny agent or customer endpoints.
• Successful session establishment events in Znuny logs for users who did not submit a password or complete a Basic auth challenge.
• New administrative actions originating from source IP addresses not previously associated with the impersonated account.
• Agent or customer logins from geographic regions or ASNs inconsistent with historical baselines for that account.

Detection Strategies

• Inspect web server and reverse proxy access logs for the Remote-User header string. Legitimate traffic should never contain this header on the client side.
• Correlate Znuny authentication log entries against web server authentication records. Discrepancies indicate header-based bypass.
• Deploy a web application firewall rule that blocks or alerts on inbound requests carrying a Remote-User header.

Monitoring Recommendations

• Forward Znuny application logs and front-end web server logs into a centralized SIEM for correlation.
• Alert on administrator-level actions performed within minutes of session creation from unfamiliar IP addresses.
• Track ticket export, user creation, and configuration-change events on affected Znuny instances until patching is confirmed.

How to Mitigate CVE-2026-93483

Immediate Actions Required

• Upgrade Znuny to a fixed release as listed in Znuny Advisory ZSA-2026-14.
• If HTTPBasicAuth is not required, switch the authentication backend to DB, LDAP, or another non-header-based module.
• Configure the fronting web server or reverse proxy to strip any inbound Remote-User header before forwarding requests to Znuny.
• Rotate credentials and session tokens for any accounts that may have been impersonated during the exposure window.

Patch Information

Znuny has published fixes in Znuny Security Advisories. Administrators should apply the version referenced in ZSA-2026-14, which removes the fallback to $ENV{HTTP_REMOTE_USER} so that only the web server-controlled REMOTE_USER variable is honored.

Workarounds

• Add a reverse proxy rule that unsets the Remote-User header on all inbound traffic, for example using RequestHeader unset Remote-User in Apache or proxy_set_header Remote-User ""; in nginx.
• Temporarily disable the HTTPBasicAuth backend in Kernel/Config.pm and fall back to database authentication until the patch is deployed.
• Restrict network access to the Znuny agent interface to trusted management networks while remediation is in progress.

# Configuration example: strip the Remote-User header at the reverse proxy
# Apache (mod_headers)
RequestHeader unset Remote-User

# nginx
proxy_set_header Remote-User "";