CVE-2026-84461: Zammad: Missing rate limiting allows password brute-forcing during two-factor login
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also revealed whether a guess was correct, even before two-factor authentication was checked. This made it possible to brute-force weak or reused passwords. This issue is fixed in version 7.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.1.2
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker can target any account at the two-factor login step and submit unlimited password guesses. The issue does not require passing two-factor authentication to determine whether a password guess is correct.
Which deployments are affected?
Zammad versions before 7.1.2 are affected. The normal account lockout and rate-limiting protections do not apply to password guesses made during the two-factor login step.
What is the immediate mitigation if upgrading is not yet possible?
The provided information does not identify a workaround. Upgrade to Zammad 7.1.2 to apply the fix.