Zammad EUVD-2026-87267

Exploitation targets the two-factor authentication login/initiation flow of a network-reachable Zammad instance prior to 7.1.2; the vulnerable endpoint verified the account password and disclosed its correctness before the second factor was evaluated, while being exempt from the normal failed-login lockout and rate limiting. No authentication or user interaction is required (PR:N/UI:N), and default configurations are affected. The practical prerequisite is that the targeted account uses two-factor authentication (so the initiation endpoint is in play); the payoff is greatest against accounts with weak or reused passwords, since the endpoint yields no direct access on its own. The primary limiting factor is that the second authentication factor still blocks actual login - the flaw's concrete impact is unlimited password brute-forcing and credential-validity disclosure, not authentication bypass.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 6.9) describes a network-reachable, low-complexity, unauthenticated flaw with confidentiality-only impact (VC:L, VI:N, VA:N), which is internally consistent with the description: the two-factor login initiation endpoint validated the password and disclosed whether it was correct before the 2FA check, while bypassing Zammad's normal failed-login lockout and rate limiting. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced - so the signal set is 'no public exploit identified at time of analysis.' Real-world risk is moderate rather than critical: the flaw does not directly grant access (an attacker still needs to pass the second factor), but it turns the 2FA initiation flow into an unlimited password oracle that enables offline-quality brute-forcing of weak or reused passwords and account-existence/credential-validity enumeration. The confidentiality-only rating is appropriate - the vulnerability itself leaks credential-validity information rather than achieving compromise. This is best treated as a meaningful hardening priority for internet-exposed Zammad instances (especially where password policies are weak), not an emergency. The commit confirms the fix adds explicit throttling (3 attempts/minute by login identifier), unifies error responses to a generic 'username or password is incorrect' message to remove the oracle, and stops counting the authenticated password re-check against lockout - corroborating that the root cause was both a missing rate limit and an observable response discrepancy (CWE-203).

A remote unauthenticated attacker targets an internet-facing Zammad instance and repeatedly submits password guesses against the two-factor authentication initiation endpoint for a chosen account. Because the endpoint reveals whether each password is correct before the 2FA step and does not trigger lockout or rate limiting, the attacker brute-forces weak or reused passwords at will and confirms valid credentials. No public exploit code is referenced, but the flaw is trivially scriptable given its low complexity.