OTRS Community Edition EUVD-2026-97258

Exploitation requires TWO specific conditions to hold simultaneously: (1) HTTP Basic Authentication must be configured as the active authentication backend in OTRS, and (2) the OTRS instance must run in a CGI or mod_perl deployment where the web server maps arbitrary inbound HTTP request headers into corresponding HTTP_* environment variables (exposing a forged 'Remote-User' header as HTTP_REMOTE_USER). Only OTRS ((Community Edition)) 6.x and prior, plus derivative products, are affected. Limiting factors that reduce real-world exploitability: it does NOT work on default installations lacking Basic Auth, does NOT affect OTRS 7+ (which uses Mojolicious/Hypnotoad and validates REMOTE_USER via an SSO shared secret), and the achievable impact is bounded by the privileges of whichever existing agent or customer account the attacker chooses to impersonate (the attacker must know a valid target username).

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:L, score 9.4) frames this as a trivially exploitable, network-reachable, unauthenticated authentication bypass (CWE-290) - on paper a top-priority flaw. However, the description materially qualifies that picture: exploitation is NOT possible against a default install. Two specific preconditions must both hold - HTTP Basic Authentication must be the configured authentication backend, AND the deployment must be CGI or mod_perl based such that inbound HTTP headers are mapped into HTTP_* environment variables. This makes the AC:L rating optimistic; the real-world attack complexity is higher because it depends on a non-default, operator-chosen configuration, which is why this analysis independently downgrades to AC:H / AT:P. No EPSS score, CISA KEV entry, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the sole source is the vendor's own advisory (OTRS-SA-2026-18). The net assessment: a genuinely serious, easy-to-weaponize bypass WHERE the vulnerable configuration exists, but the configuration dependency and the EOL status of the affected product (Community Edition 6.x and prior) likely narrow the exposed population considerably. Treat as high priority for anyone still running OTRS CE 6 with Basic Auth under CGI/mod_perl; lower practical urgency elsewhere.

An attacker identifies an internet-facing OTRS Community Edition 6.x Generic Interface endpoint running under CGI/mod_perl with HTTP Basic Authentication as the backend. They send a request containing a forged 'Remote-User' HTTP header set to the username of an existing agent or administrator; the web server exposes it as HTTP_REMOTE_USER, which OTRS trusts as an already-authenticated identity without any password check. No public exploit code was provided in the input, but the technique is a simple single-header spoof requiring no special tooling.