CVE-2026-34720: 
NixOS vulnerability analysis and mitigation

CVE-2026-34720 is an origin validation error in the Single Sign-On (SSO) mechanism of Zammad, a web-based open source helpdesk and customer support system. The vulnerability allows the SSO mechanism to process authentication headers without verifying they originate from a trusted SSO proxy or gateway. Affected versions include all Zammad releases prior to 6.5.4 and version 7.0.0. It was published on April 8, 2026, with patches released in versions 7.0.1 and 6.5.4. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-346 (Origin Validation Error): Zammad's SSO mechanism fails to verify that incoming authentication headers originate from a trusted SSO proxy or gateway before acting on them. An authenticated, low-privileged attacker with network access could craft or manipulate SSO headers to influence authentication decisions, potentially bypassing access controls. Exploitation requires attack prerequisites to be present (e.g., an SSO configuration must be active) and high attack complexity, limiting the practical exploitability. No public proof-of-concept code has been identified (GitHub Advisory).

Successful exploitation could allow a low-privileged authenticated attacker to manipulate SSO authentication headers, potentially gaining unauthorized access to other accounts or bypassing authentication controls within the Zammad helpdesk system. The primary impacts are limited confidentiality and integrity compromise of the vulnerable system; availability is not affected. There is no evidence of impact on subsequent or downstream systems based on current scoring (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit for CVE-2026-34720. The EPSS score is approximately 0.019%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already hold low-level privileges and for SSO to be configured and active, further limiting the attack surface (GitHub Advisory).

Zammad has released patched versions 7.0.1 and 6.5.4 that address this vulnerability by enabling proper configuration of trusted SSO proxy/gateway sources. Users running any version prior to 6.5.4 or running version 7.0.0 should upgrade immediately to 7.0.1 or 6.5.4+. As an interim measure, administrators should restrict network-level access to Zammad instances and ensure SSO headers are only accepted from known, trusted proxy or gateway IP addresses. Reviewing SSO configurations and authentication logs for anomalous patterns is also recommended (GitHub Advisory).