# CVE-2026-93483: Znuny HTTPBasicAuth header spoofing authentication bypass

Source: https://junglewise.ai/threats/cve-2026-93483-in-znuny-through-7-3-6-an-attacker-can-bypass-specific-standard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-93483 · Severity: info · Published 2026-10-15

Znuny is a ticket management and helpdesk system used by organizations to track support requests and customer interactions. An attacker can gain unauthorized access to any user account, including administrator accounts, by forging a single HTTP request header, without needing a password. This allows an attacker to impersonate users, access confidential support tickets, and modify system settings.

Technologies: [Znuny](https://junglewise.ai/threats/technologies/znuny), [Znuny LTS](https://junglewise.ai/threats/technologies/znuny-lts). Vendors: [Znuny](https://junglewise.ai/threats/vendors/znuny).

## Quick answers

**Is CVE-2026-93483 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93483 being exploited in the wild.

**How severe is CVE-2026-93483?** Informational severity, published 15 October 2026.

**Which products and versions are affected?** Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, 7.2, and 7.3.1 through 7.3.6; Znuny LTS 6.5.1 through 6.5.24.

**Is there a fix for CVE-2026-93483?** Yes: fixed in Znuny 7.3.7, Znuny LTS 6.5.25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93483 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-93483?** Check whether you run Znuny or Znuny LTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Znuny 7.3.7, Znuny LTS 6.5.25

## Technical details

The HTTPBasicAuth authentication modules (for both agent and customer interfaces) trust the HTTP_REMOTE_USER header as a fallback for the username when the primary $ENV{REMOTE_USER} variable is unavailable. An attacker can forge the "Remote-User" request header to impersonate any existing user on systems configured to use HTTPBasicAuth for authentication. This is a header spoofing vulnerability requiring only network access and no user interaction or credentials.

## Affected products

- Znuny Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, 7.2, and 7.3.1 through 7.3.6
- Znuny Znuny LTS 6.5.1 through 6.5.24

## Timeline

- 2026-09-16: advisory
- 2026-10-15: disclosed

## References

- [https://www.znuny.org/advisories](https://www.znuny.org/advisories)
- [https://www.znuny.org/en/advisories/zsa-2026-14](https://www.znuny.org/en/advisories/zsa-2026-14)

## Related threats

- [Znuny AgentTicketEmailResend template XSS](https://junglewise.ai/threats/cve-2026-77506-znuny-agentticketemailresend-template-xss)
- [Znuny reflected XSS in AdminCommunicationLog](https://junglewise.ai/threats/cve-2026-50592-znuny-reflected-xss-in-admincommunicationlog)
- [Znuny stored XSS in user preferences](https://junglewise.ai/threats/cve-2026-50591-znuny-stored-xss-in-user-preferences)
- [Znuny reflected XSS in customer.pl OTRSCustomerInterface parameter](https://junglewise.ai/threats/cve-2025-52204-znuny-reflected-xss-in-customer-pl-otrscustomerinterface)