The vulnerability allows a Knowledge Base editor to craft an embedded video widget that contains unescaped iframe attributes. When a user with permission to switch sessions views the rendered answer, the malicious HTML automatically sends a request to Zammad’s session‑switching endpoint while using the viewer’s active credentials. This silently switches the user to an account chosen by the attacker. The flaw is an input validation weakness that injects malicious HTML, enabling the attacker to hijack a legitimate user’s session without any interaction beyond opening the page.

Zammad’s web‑based helpdesk system is affected. Any release prior to version 7.1.2, regardless of minor version, is vulnerable if the Knowledge Base video widget can be edited by users with content‑editing rights. The issue is fixed in 7.1.2 and later.

The CVSS score of 6.3 indicates a medium‑severity weakness. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting limited current exploitation activity. The attack vector is a local browser rendering the affected Knowledge Base answer; the attacker only needs to embed malicious content and a victim must open that page. Once this occurs, session hijacking is immediate and silent, giving the attacker full control over the victim’s account. The risk remains significant for environments where Knowledge Base editors and session‑switching users coincide.