Authentication Token Vulnerability in OTRS by OTRS AG

CVE-2026-78357

What is CVE-2026-78357?

A security lapse in OTRS allows previously issued authentication tokens to remain valid after an agent or customer user account is deactivated or its password is altered. This delay in token invalidation can result in a valid JWT being exploitable up to approximately 16 hours post-deactivation. Attackers who have previously acquired a legitimate token can maintain access to OTRS, leveraging the rights of the deactivated account. The severity of access depends on the token's privileges; customer user tokens are confined to the user's permissions, whereas agent tokens may grant broader access to tickets and administrative features. This vulnerability poses a significant risk for organizations using affected versions of OTRS.

References