CVE-2026-93483 Auth bypass in Znuny
Attackers can bypass authentication and impersonate any user, including admins, by forging the Remote-User header in Znuny systems using HTTPBasicAuth.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93483?
CVE-2026-93483 is a critical authentication bypass vulnerability in Znuny, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.
Weakness: CWE-348
Which versions are affected by CVE-2026-93483?
How do I fix CVE-2026-93483?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-93483 being exploited?
There is no known exploitation of CVE-2026-93483 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-93483, GHSA-g4fx-r8m5-c6r7, UBUNTU-CVE-2026-93483.