Executive Summary

CVE-2026-34721 is a Cross-Site Request Forgery (CSRF) vulnerability in the OAuth callback endpoints of the Zammad helpdesk system versions prior to 7.0.1 and 6.5.4.

Specifically, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This means the system does not properly verify that requests come from legitimate users, allowing attackers to potentially perform unauthorized actions by exploiting this lack of verification.

The vulnerability was fixed by adding CSRF state parameter validation in versions 7.0.1 and 6.5.4.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to perform unauthorized actions on the Zammad system by exploiting the lack of CSRF state parameter validation in OAuth callback endpoints.

The impact includes a low confidentiality impact but a high integrity impact, meaning attackers could potentially manipulate or alter data or actions within the system without proper authorization.

The attack can be performed remotely over the network, requires low privileges, and does not require user interaction, making it a moderate risk.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the CSRF vulnerability in Zammad's OAuth callback endpoints directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the OAuth callback endpoints in Zammad not validating a CSRF state parameter for Microsoft, Google, and Facebook external credentials. Detection would involve verifying whether the OAuth callback endpoints properly validate the CSRF state parameter.

Since the vulnerability is related to missing CSRF state parameter validation, one way to detect it is to monitor OAuth callback requests and check if the state parameter is being validated or enforced.

No specific commands or detection tools are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Zammad to a fixed version where the vulnerability is addressed.

• Upgrade to Zammad version 7.0.1 or later.
• Alternatively, upgrade to version 6.5.4 or later if using the 6.5.x branch.

These versions include validation of the CSRF state parameter on OAuth callback endpoints, preventing exploitation of this vulnerability.

Useful 0 Not Useful 0