Executive brief
Zammad is an open-source customer support and helpdesk platform. A security flaw in how the system handles logins from Microsoft, Google, and Facebook could allow an attacker to trick a user's browser into performing unauthorized actions. This could lead to an attacker linking their own social media or email credentials to a victim's helpdesk account, potentially gaining unauthorized access to sensitive support tickets and customer data.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Zammad's OAuth implementation. The application fails to validate the 'state' parameter during the OAuth callback process for Microsoft, Google, and Facebook authentication providers. An attacker can exploit this by inducing a logged-in user to visit a malicious site, which then triggers a forged request to the Zammad callback endpoint. This can result in an attacker's external identity being associated with the victim's Zammad account. The issue is resolved in versions 6.5.4 and 7.0.1 by enforcing state parameter validation across all supported OAuth providers.
Affected products
- Zammad Zammad < 6.5.4, >= 7.0.0-alpha, < 7.0.1
Timeline
- 2026-04-08: advisory: Vendor advisory published via GitHub
- 2026-04-08: disclosed: CVE published