An authentication bypass vulnerability in Zammad allows unauthenticated attackers to impersonate any user, including administrators, by exploiting improper SSO identity linking.

This is an improper authentication flaw (CWE-287) where the application automatically binds third-party SSO identities to existing accounts based solely on unverified email addresses. An unauthenticated attacker can control an identity at a configured provider and force an account takeover by setting the attacker-controlled email to match a target victim.

The ability for an unauthenticated actor to bypass authentication and gain full access to any user account, including administrative and agent accounts, represents a critical security risk. This vulnerability could lead to total compromise of the helpdesk system, unauthorized access to sensitive customer support data, and potential lateral movement within the organization. With a CVSS score of 9.1, this flaw is categorized as critical due to its ease of exploitation and high impact on confidentiality and integrity.

Immediate Action: Upgrade Zammad to version 7.1.2 or later immediately to resolve the authentication logic flaw.

Proactive Monitoring: Review system authentication logs for unusual login patterns or multiple successful logins from different SSO providers for the same user account.

Compensating Controls: Disable the "Automatic account link on initial logon" feature within the Zammad settings until the patch can be applied to prevent automated exploitation.

Public Exploit Available: No (exploit_available: unknown)

Given the critical severity and the potential for total account takeover, organizations must prioritize updating their Zammad instances to version 7.1.2. The reliance on unverified email claims in SSO flows is a significant architectural weakness, and failing to patch exposes the entire user base to unauthorized access. Immediate remediation is required to maintain the security and integrity of your support infrastructure.