Zammad’s two‑factor login step lets an attacker try an unlimited number of password guesses for any account, without the normal lockout or rate‑limiting controls. The response also indicates whether a guess was correct before the two‑factor token is verified, which enables efficient brute‑forcing of weak or reused passwords. This flaw is a type of authentication bypass and can lead to compromise of user credentials.

The issue affects all installations of Zammad prior to version 7.1.2. Administrators running Zammad 7.0.x or earlier are vulnerable. All user accounts, regardless of two‑factor configuration, can be targeted.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Nevertheless, the flaw can be leveraged remotely over the web interface, with no local privileges required. Attackers would need only network access to the Zammad server and an existing username to attempt the brute‑force attack.