CVE-2026-93483

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.

• CWE-348

• https://www.znuny.org/advisories
• https://www.znuny.org/en/advisories/zsa-2026-14

Published

Oct 15, 2026

Last Modified

Oct 19, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93471Improper Handling of Highly Compressed Data (Data Amplificat…8.7
• CVE-2026-93474Charging station authentication identifiers are publicly acc…6.5
• CVE-2026-93475The X.509 parser in NetX Secure accepts an RSA public key of…9.3
• CVE-2026-93477Improperly Controlled Modification of Dynamically-Determined…5.9
• CVE-2026-93479A vulnerability exists in NGINX Plus and NGINX Open Source w…8.1
• CVE-2026-9348A vulnerability was found in Edimax EW-7438RPn up to 1.31. A…8.8
• CVE-2026-93484Znuny through 7.3.6 constructs a ticket-search database quer…8.6
• CVE-2026-93485Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-93488A flaw was found in Netty. SpdySessionHandler accepts an unl…7.5
• CVE-2026-93489Improper Authentication in ASUS router modules allows an una…8.7
• CVE-2026-9349A vulnerability was determined in calcom cal.diy up to 4.9.4…5.5
• CVE-2026-93491A flaw was found in Netty's HttpServerCodec. A remote, unaut…7.5