Zammad allows an attacker in control of a third‑party identity provider to bind that identity to an existing user account by matching the email address reported by the provider. The process does not verify that the provider actually owns the email; it merely accepts the address supplied. An attacker can therefore create or hijack an identity whose email is set to a victim’s address, authenticate, and be logged in as the victim, bypassing the victim’s local password and any other authentication factors. This flaw is rooted in CWE‑287, an authentication bypass weakness that enables an attacker to impersonate a legitimate user without authorization.

The vulnerability exists in all Zammad installations prior to version 7.1.2 when the "Automatic account link on initial logon" setting is enabled. The flaw permits takeover of all user accounts, including agents and administrators, because the leaked identity mapping connects the attacker’s SSO credentials directly to the victim’s account.

The CVSS score of 9.1 reflects the high impact, complete loss of confidentiality, integrity, and availability due to account takeover. The EPSS score is not available, but the vulnerability can be exploited by any entity controlling an identity at a configured provider; for example, any Azure AD tenant configured with the multi‑tenant Microsoft 365 /common app registration. Because the flaw is purely server‑side and does not require user interaction beyond authenticating via SSO, the attack can be executed remotely from anywhere with network access to the authentication endpoint. The vulnerability is not listed in the CISA KEV catalog, yet the potential for high‑scale impact warrants immediate remediation.