Threats affecting pkg:github/Znuny

CVE-2026-93483 is a critical vulnerability in Znuny versions before 6.5.25 and 7.3.7 that allows attackers to bypass authentication by manipulating the Remote-User HTTP header. This flaw arises because the application trusts the Remote-User header, enabling attackers to impersonate any user, including administrators, without a password. The vulnerability affects the HTTPBasicAuth modules used for agent and customer login interfaces. A fix is available in Znuny versions 6.5.25 and 7.3.7.