CVE-2026-84461

Received Received - Intake

Brute-Force Vulnerability in Zammad Prior to 7.1.2

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also revealed whether a guess was correct, even before two-factor authentication was checked. This made it possible to brute-force weak or reused passwords. This issue is fixed in version 7.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-84461

EUVD

EUVD-2026-87267

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	7.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
CWE-203	The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CWE-799	The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

Attack-Flow Graph

Executive Summary

This vulnerability is in Zammad, an open source helpdesk system. Before version 7.1.2, the two-factor login step allowed unlimited password guesses for any account without triggering lockout or rate limiting. The system also revealed if a password guess was correct before checking two-factor authentication, enabling brute-force attacks on weak or reused passwords.

Detection Guidance

Detecting this vulnerability requires checking the Zammad version in use. If your system runs a version prior to 7.1.2, it is vulnerable. Check the version by running commands like 'zammad version' or inspecting the web interface's footer. Monitor authentication logs for unusual password guess attempts or failed login spikes.

Impact Analysis

An attacker could exploit this to gain unauthorized access to any account by guessing passwords without restrictions. This risks exposing sensitive customer support data, internal communications, or other confidential information stored in Zammad.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Zammad to version 7.1.2 or later immediately. If upgrading is not possible, disable two-factor authentication temporarily or implement additional rate limiting and account lockout mechanisms. Review and strengthen password policies to prevent brute-force attacks.

Hi! I’m here to help you understand CVE-2026-84461. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70