The identified flaw resides in Zammad's OAuth callback endpoints for Microsoft, Google, and Facebook. Because the applications fail to verify the CSRF state parameter, an attacker can forge requests that the server will accept as legitimate. This permits the unauthorized execution of actions tied to an authenticated user, potentially resulting in compromised user sessions or unauthorized access to internal resources.

The affected product is Zammad Zammad. Versions prior to 7.0.1 in the 7.x branch and prior to 6.5.4 in the 6.x branch are vulnerable. These releases were distributed as open‑source web applications that provide customer support functionality.

With a CVSS score of 5.9 the severity is moderate. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires an active HTTP session of a logged‑in user and a malicious site to issue a crafted request to the callback endpoint; this inference is drawn from the absence of state validation. An attacker who can coerce users into visiting a malicious host can exploit the vulnerability to perform unauthorized actions through the authenticated session.