HTTP Basic Authentication Vulnerability in OTRS Community Edition by OTRS

CVE-2026-93582

What is CVE-2026-93582?

In OTRS Community Edition 6 and prior versions, a vulnerability exists within the HTTP Basic Authentication modules where the application accepts an authenticated username from the REMOTE_USER or HTTP_REMOTE_USER environment variable. This flaw allows unauthenticated remote attackers to craft a malicious Remote-User request header, which is interpreted by OTRS as a trusted username without additional password checks. Consequently, attackers can impersonate legitimate users, gaining unauthorized access to sensitive information and the ability to modify data based on the privileges of the impersonated account. This vulnerability can only be exploited if the HTTP Basic Authentication method is set up and the attacker’s controlled HTTP headers are utilized in the server environment. OTRS version 7 and later are secured against this vulnerability due to architectural enhancements that prevent such exposure.

References