SecBoard
Zurück zur CVE-Übersicht

CVE-2026-84458

NONE
Risk Signal Score0/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party (SSO) identity to an existing local account by matching the email address the identity provider reports, without verifying that the provider actually confirmed ownership of that email. An attacker who controls any identity at a configured provider, including, by default, any Azure AD tenant via Zammad's multi-tenant Microsoft 365 /common app registration, can set that identity's email to a victim's address, authenticate, and be logged in as the victim. This bypasses the victim's local password entirely and affects any existing account, including agents and administrators. Zammad will honor the xms_edov ID token claim when email verification is required in the Microsoft 365 setting, treating a missing claim as unverified. This issue is fixed in version 7.1.2.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 7.1.2

Threat-Hunting-Queries

Detection of account takeover attempts via unverified email matching during SSO auto-link. This requires logging of SSO authentication events and email address claims.

Sentinel/Defender KQL

IdentityLogonEvents
| where Protocol == "SSO" and isnotempty(AccountUpn)
| summarize LoginCount = count() by AccountUpn, bin(TimeGenerated, 1h)
| where LoginCount > 1 // Look for multiple logins with the same UPN in a short period, potentially from different identity providers or with changed email claims
| project AccountUpn, LoginCount, TimeGenerated

Splunk SPL

sourcetype=zammad_sso_logs (event_type="sso_login" OR event_type="account_link") email=* NOT email="" | stats count by email, user, _time | where count > 1

Sigma

title: Zammad SSO Account Takeover Attempt
logsource:
  product: zammad
  service: sso
detection:
  selection:
    event_type: ["sso_login", "account_link"]
    email: "*"
  condition: selection | groupby email, user | having count() > 1
level: high

Elastic ES|QL

from zammad_sso_logs
| where event_type in ("sso_login", "account_link") and not is_null(email)
| stats count() as login_count by email, user, @timestamp
| where login_count > 1

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen