CVE-2026-84458 Details

A critical vulnerability in Zammad versions prior to 7.1.2 allows for account takeover through unverified email matching during single sign-on (SSO) auto-linking. When the 'Automatic account link on initial logon' feature is enabled, Zammad links an incoming SSO identity to an existing local account by comparing the email address provided by the identity provider. However, it fails to verify whether the provider has confirmed ownership of that email. This flaw enables an attacker controlling an identity at a configured provider, such as any Azure Active Directory tenant via Zammad's multi-tenant Microsoft 365 '/common' app registration, to replace the identity's email with that of a victim, authenticate, and gain access to the victim's account, including those of agents and administrators. The vulnerability bypasses the need for the victim's password. Although Zammad can require email verification for Microsoft 365 accounts, the default setting allows unverified emails to be linked, creating a loophole for exploitation.

Users can update to Zammad version 7.1.2 or later, where this vulnerability has been patched.