PT-2026-31418 · Microsoft+3 · Microsoft+3

Published 2026-04-08 · Updated 2026-04-09 · CVE-2026-34721

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.1 and prior to 6.5.4

Description The OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This could allow an attacker to potentially compromise accounts.

Recommendations Update to version 7.0.1 or later. Update to version 6.5.4 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-34721

Affected Products

Facebook

Google

Microsoft

Zammad

References · 4

• https://github.com/zammad/zammad/security/advisories/GHSA-mfwp-hx66-626c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34721 · Security Note
• https://twitter.com/CVEnew/status/2041975601821536610 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042049743245774964 · Twitter Post