Update Znuny now to block header-based login bypass in older versions

Zuny allows attackers to log in as any user, including administrators, by simply changing a value in a web request header. This bypasses standard password checks entirely.

In plain English

The National Vulnerability Database records this issue as CVE-2026-93483 with a CVSS score of 9.5, which is considered critical. The problem occurs because the software trusts information sent by the browser rather than verifying it securely. Specifically, the application looks for a username in a field that attackers can easily fake.

When a user logs in, the system usually checks a secure value set by the web server. However, if that value is missing, the code falls back to checking a different source. This secondary source is an HTTP header called Remote-User. Because browsers allow users to send custom headers, an attacker can set this value to any username they choose.

The background

According to the NVD record, the vulnerability exists in Znuny through version 7.3.6. It specifically impacts systems where HTTPBasicAuth is configured as the authentication backend for either the agent or customer interfaces. The modules Kernel::System::Auth::HTTPBasicAuth and Kernel::System::CustomerAuth::HTTPBasicAuth are responsible for reading the username.

These modules read the username from the environment variable REMOTE_USER, which is set by the web server after successful authentication. If that variable is empty, the code checks HTTP_REMOTE_USER instead. This second variable is populated directly from the Remote-User request header. Since this header is controlled by the client, it is not a trusted source for identity verification.

What changes now

The flaw allows unauthorized access to sensitive system functions and confidential data. An attacker does not need to guess passwords or exploit complex code execution bugs. They only need to know a valid username on the system. By sending a request with a forged Remote-User header, they can impersonate that user.

This grants full access to system controls. The weakness is classified under CWE-348, which relates to incorrect security checks. The NVD notes that this affects Znuny versions before 6.5.25 and before 7.3.7. Users running these older versions are exposed to this risk immediately.

Key terms explained

An HTTP header is a piece of metadata sent with web requests. Browsers send headers to tell servers how to process the page. Some headers, like those containing user credentials, should be set only by secure servers, not by the user's browser. When software trusts a header that the user can edit, it creates a security gap. Teams usually check their authentication configurations to ensure they rely on server-verified tokens rather than client-sent data.

What to do and how to stay safe: Znuny

• Check if your Znuny installation is version 7.3.6 or earlier, or 6.5.24 or earlier.
• Review server logs for unusual login attempts or requests containing custom Remote-User headers.
• Ensure your web server is configured to strip or ignore untrusted headers before they reach the application.
• Plan to upgrade to version 7.3.7 or 6.5.25 once the vendor provides an update.

Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Znuny versions are affected by this header bypass?

Versions before 6.5.25 and before 7.3.7 are affected by CVE-2026-93483.

How does an attacker exploit this vulnerability?

An attacker sends a request with a forged Remote-User header to impersonate a valid user.

Is a patch available for this issue?

The source material identifies versions 7.3.7 and 6.5.25 as the boundaries, implying newer versions are safe, but does not explicitly confirm a patch release process.