# CVE-2026-93582: OTRS Community Edition HTTP authentication header spoofing

Source: https://junglewise.ai/threats/cve-2026-93582-the-http-basic-authentication-modules-in-otrs-community-edition-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-93582 · Severity: critical · CVSS 9.4 · Published 2026-10-12

OTRS Community Edition 6 and earlier trusts HTTP request headers for user authentication when HTTP Basic Authentication is configured, allowing an unauthenticated attacker to forge authentication by providing a crafted Remote-User header. An attacker can impersonate any existing user without knowing credentials, gaining access to confidential data and the ability to modify configuration with the victim's permissions. OTRS 7 and later are not affected.

Technologies: [Otrs Community Edition](https://junglewise.ai/threats/technologies/otrs-community-edition-1). Vendors: [Otrs](https://junglewise.ai/threats/vendors/otrs).

## Quick answers

**Is CVE-2026-93582 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93582 being exploited in the wild.

**How severe is CVE-2026-93582?** Critical severity, with a CVSS score of 9.4, published 12 October 2026.

**Which products and versions are affected?** Otrs Community Edition 6 and prior.

**Is there a fix for CVE-2026-93582?** Yes: fixed in OTRS 7 and later. Until then: Ensure HTTP Basic Authentication is not configured as the authentication backend, or deploy with Hypnotoad/Mojolicious (OTRS 7+) which does not expose arbitrary HTTP headers through environment variables. Validate the REMOTE_USER mechanism through the configured SSO shared secret if HTTP Basic Authentication must be used. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93582 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-93582?** Check whether you run Otrs Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OTRS 7 and later

Ensure HTTP Basic Authentication is not configured as the authentication backend, or deploy with Hypnotoad/Mojolicious (OTRS 7+) which does not expose arbitrary HTTP headers through environment variables. Validate the REMOTE_USER mechanism through the configured SSO shared secret if HTTP Basic Authentication must be used.

## Technical details

The vulnerability exists in the HTTP Basic Authentication module which accepts usernames from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl deployments, HTTP request headers are mapped to HTTP_* environment variables, allowing an attacker to supply a crafted Remote-User header that the application treats as pre-authenticated without password verification. This affects only deployments where HTTP Basic Authentication is configured as the authentication backend and the web server exposes arbitrary request headers through environment variables.

## Affected products

- OTRS Community Edition 6 and prior

## Timeline

- 2026-10-12: disclosed

## Related threats

- [OTRS cross-site request forgery in administrative actions](https://junglewise.ai/threats/cve-2026-78358-several-administrative-actions-do-not-sufficiently-validate)