Znuny: Authentication bypass via forged Remote-User header in HTTPBasicAuth
Summary
Znuny's HTTPBasicAuth login modules for the agent and customer interfaces fall back to the HTTP_REMOTE_USER environment variable, which is taken directly from a client-supplied Remote-User header. An unauthenticated remote attacker can use a forged header to log in as any existing user, including administrators, without credentials. The flaw only applies where HTTPBasicAuth is configured as the authentication backend, and it grants full access to tickets and system configuration.
Affected
- Znuny LTS 6.5.1 to 6.5.24 (CNA range: 0 to below 6.5.25)
- Znuny 7.3.1 to 7.3.6 (CNA range: 7.0.0 to below 7.3.7)
- Only installations using HTTPBasicAuth as the authentication backend
- Other Znuny 6.x and 7.0 to 7.2 versions are listed as affected by the vendor advisory; the CNA range covers them as well
Fixed in
- Znuny LTS 6.5.25
- Znuny 7.3.7
- No fixed 6.0 LTS release found in the sources. Unknown.
Workaround
- Configure the web server or reverse proxy to strip client-supplied Remote-User headers from incoming requests.
- Set the Remote-User header only internally after successful upstream authentication.
- Switching away from HTTPBasicAuth would remove the exposure, but no official vendor workaround confirms this.
Exploitation
- CISA KEV: not listed.
- CISA SSVC: exploitation none, not automatable.
- No public exploit found in GitHub or Exploit-DB as of the research date.
- In-the-wild exploitation: conflicting reports, unconfirmed.
- EPSS is low (about 0.23%).
Our recommendation
- Check whether any Znuny instance uses HTTPBasicAuth as its authentication backend.
- Update exposed instances to Znuny LTS 6.5.25 or Znuny 7.3.7 as a priority.
- Until patching is complete, strip the Remote-User header at the reverse proxy or load balancer.
- Review logs for logins without a password or with unexpected Remote-User values.
- Verify version details against the vendor advisory ZSA-2026-14 before rollout.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Znuny advisory ZSA-2026-14 www.znuny.org
- Znuny advisory index www.znuny.org
- VulDB CVE-2026-93483 vuldb.com
- VulDB vulnerability 420466 vuldb.com
- OpenCVE CVE-2026-93483 app.opencve.io
- DevGuard CVE-2026-93483 docs.devguard.org
- Vulners CVE-2026-93483 vulners.com
- Ubuntu CVE-2026-93483 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:32.
Original description (NVD)
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.