The flaw in Zammad’s single sign‑on (SSO) mechanism lies in the omission of origin validation for the SSO header. As a result, an attacker who can forge this header has the potential to trick Zammad into accepting an authentication request on behalf of another user. The weakness is classified as CWE‑346, indicating that untrusted domain data is used without adequate validation. Though the CVSS score of 2.3 signals a low severity, the primary risk is that an attacker could impersonate a legitimate user or gain unauthorized access to the system’s functionality.

All releases of Zammad prior to version 7.0.1 and 6.5.4 are affected. Updating to at least these minimum versions or newer ensures that the SSO header origin is properly verified and the vulnerability is mitigated.

With a CVSS of 2.3, the overall risk is low and the CVE is not listed in the CISA KEV catalog. EPSS information is not available. The likely attack vector is inferred to be a forged HTTP request containing a malicious SSO header that bypasses server‑side origin checks. No additional privileges or local access are required, and the vulnerability does not lead to code execution or data exfiltration beyond the scope of impersonation.