Can attackers hijack Znuny accounts by forging HTTP headers in vulnerable versions?

The short version

• Znuny trusts a user-controllable HTTP header for authentication in older versions.
• This allows unauthenticated access to sensitive system functions and admin accounts.
• The vulnerability exists in HTTPBasicAuth modules for agent and customer interfaces.

The details

Znuny versions before 7.3.7 and 6.5.25 contain a severe authentication bypass, according to the National Vulnerability Database. The flaw, tracked as CVE-2026-93483, carries a CVSS score of 9.5, classified as critical. An attacker can bypass standard login procedures by manipulating a specific HTTP request header. The application incorrectly trusts this header, allowing the impersonation of any user, including administrators, without requiring a password.

The issue resides in the HTTPBasicAuth modules for both the agent and customer interfaces. Specifically, the modules read the username from the environment variable set by the web server after successful authentication. However, they also use a fallback mechanism that reads from a variable populated directly by the attacker-controllable Remote-User request header. This design choice grants full access to confidential data and system controls when HTTPBasicAuth is configured as the authentication backend.

The context

The weakness is categorised under CWE-348, which relates to reliance on untrusted data. In affected Znuny environments, the system fails to distinguish between server-set variables and client-supplied headers. This allows an attacker to log in as any existing user by simply sending a request with a forged Remote-User header. No credentials are required for this action. The vulnerability is present in all Znuny versions prior to 6.5.25 and 7.3.7.

Next steps

Organisations running Znuny should immediately verify their current version against the affected list. If the installation is prior to 7.3.7 or 6.5.25, it is vulnerable. Teams should check whether HTTPBasicAuth is configured as an authentication backend. If it is, the system is exposed to unauthenticated access. No fix has been confirmed yet in the provided material, so isolating affected systems may be necessary until an update is available.

What defenders should look for

Security operations teams should monitor web server logs for unusual authentication patterns. Look for successful logins that lack corresponding password validation events or show suspicious header values. Check for rapid access to administrative functions by users who typically do not perform such actions. Verify that authentication backends are configured securely and do not rely on client-supplied data for identity verification. Investigate any sudden spikes in access to sensitive system controls or confidential data exports.

What to do and how to stay safe: Znuny

• Audit your Znuny installation version and compare it against the affected ranges.
• Review authentication backend configurations to ensure HTTPBasicAuth is not relying on untrusted headers.
• Monitor access logs for successful logins that bypass standard credential checks.
• Restrict network access to Znuny interfaces until a vendor update is available.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Znuny versions are affected by CVE-2026-93483?

Znuny versions before 6.5.25 and before 7.3.7 are affected.

What is the CVSS score for this vulnerability?

The CVSS score is 9.5, which is rated as critical.

How does an attacker exploit this flaw?

An attacker manipulates the Remote-User HTTP request header to bypass login procedures.