CVE-2026-93582: CWE-290 Authentication Bypass by Spoofing in OTRS GmbH (former OTRS AG) OTRS

The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either REMOTE_USER or HTTP_REMOTE_USER environment variables. In CGI and mod_perl deployments, HTTP request headers map to HTTP_* environment variables, allowing an attacker to supply a crafted Remote-User header that sets HTTP_REMOTE_USER. When HTTP Basic Authentication is configured, OTRS trusts HTTP_REMOTE_USER as an authenticated username without further password verification. This enables an unauthenticated remote attacker to authenticate as any existing agent or customer user, depending on the account impersonated. OTRS 7 and later are not vulnerable due to the use of Mojolicious/Hypnotoad, which does not expose arbitrary request headers through %ENV, and requires validation via an SSO shared secret. The HTTP_REMOTE_USER fallback has been removed in newer versions as a security hardening measure.

Successful exploitation allows an unauthenticated attacker to bypass authentication and impersonate any existing user in OTRS Community Edition 6 and earlier. The attacker gains the privileges of the impersonated user, which may include access to confidential information and the ability to modify data or system configuration. This can lead to significant confidentiality and integrity impacts. Availability impact is low but present due to potential limited disruption.

OTRS 7 and later versions are not affected and include architectural changes that prevent this vulnerability. Users of OTRS Community Edition 6.x and earlier should upgrade to version 7 or later to remediate this issue. Since no official patch links are provided, upgrading to a non-vulnerable major version is the recommended remediation. If upgrading is not immediately possible, disabling HTTP Basic Authentication or ensuring the web server environment does not expose attacker-controlled HTTP headers as environment variables may mitigate the risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.