OTRS Community Edition: Authentication bypass via spoofed Remote-User header
Summary
OTRS Community Edition 6 and earlier accept the username from the HTTP_REMOTE_USER environment variable when HTTP Basic Authentication is the authentication backend. An unauthenticated remote attacker can send a crafted Remote-User header to log in through the Generic Interface as an existing agent or customer without knowing the password. The impact depends on the impersonated account and can include access to confidential data and changes to data or configuration. Exploitation requires HTTP Basic Authentication as backend and a web server that exposes request headers as HTTP_* variables.
Affected
- ((OTRS)) Community Edition 6.x and earlier
- Products based on ((OTRS)) Community Edition, which the vendor considers very likely affected (forks such as Znuny or OTOBO: check each vendor's advisories)
- Not affected per vendor: OTRS 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x
Fixed in
Unknown for ((OTRS)) Community Edition 6.x. No fixed 6.x release is known to address this CVE.
- The CVE record's solution is to update to the latest OTRS version (2026.7.1 or later), which means migrating away from CE 6.x.
Workaround
- Disable HTTP Basic Authentication as the authentication backend, if it is not required.
- Strip client-supplied Remote-User and HTTP_REMOTE_USER headers at the reverse proxy or web server (verify in the actual configuration).
- Restrict access to the Generic Interface and the login pages to trusted IP addresses or a VPN.
- These measures are not vendor-provided and do not replace migration.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No evidence of exploitation in the wild and no public proof-of-concept found at the time of research.
- EPSS score 0.00392 (low predicted exploitation probability).
Our recommendation
- Inventory all OTRS and ((OTRS)) CE instances, including version and whether HTTP Basic Authentication is the backend.
- Immediately restrict external access to affected instances and filter Remote-User headers at the proxy.
- Plan migration to a supported OTRS release or a maintained fork, after checking that fork's advisories.
- Review logs for requests with Remote-User headers and for unexpected logins, especially to admin accounts; if an exposed instance was reachable, review accounts, tickets and configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OTRS Security Advisory 2026-18 otrs.com
- Ubuntu security notice CVE-2026-93582 ubuntu.com
- CVE record mirror (cvelist) vulners.com
- OpenCVE CVE-2026-93582 app.opencve.io
- OSV Ubuntu CVE-2026-93582 osv.dev
- The Hacker Wire CVE-2026-93582 www.thehackerwire.com
- Community Edition and Znuny overview www.getmacha.com
- OTRS Community Edition product page otrs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:07.
Original description (NVD)
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment variables. As a result, an unauthenticated remote attacker can supply a crafted Remote-User request header which is exposed to the application as HTTP_REMOTE_USER. When HTTP Basic Authentication is configured as the authentication backend, OTRS trusts this value as an already authenticated username and does not perform an additional password verification. An attacker may therefore authenticate through the Generic Interface as an existing agent or customer user without knowing the corresponding credentials. The resulting privileges depend on the account being impersonated. Successful exploitation may allow access to confidential information and modification of data or configuration with the permissions of the affected user. Exploitation requires HTTP Basic Authentication to be configured as an authentication backend and a web server environment in which attacker-controlled HTTP headers are exposed through the corresponding HTTP_* environment variables. OTRS 7 and later are not affected by this attack vector due to the use of Mojolicious/Hypnotoad and does not expose arbitrary request headers through %ENV in the manner required for exploitation. The supported REMOTE_USER mechanism additionally requires validation through the configured SSO shared secret. The unused HTTP_REMOTE_USER fallback has nevertheless been removed as a security-hardening measure. Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.