CVE-2026-63208

Received Received - Intake

Microsoft Graph Token Exposure in Zammad Helpdesk System

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the token format Microsoft uses (JWT), only the first part is hidden, while the remaining parts remain readable in plain text. A Zammad admin with Microsoft Graph channel access can view these logs and see the partial token, which may reveal sensitive claims such as the account scope, tenant, or timing, and could assist in reconstructing the full token while it is still valid. This issue is fixed in version 7.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-63208

EUVD

EUVD-2026-87271

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	to 7.1.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

Zammad is a helpdesk system that logs errors when Microsoft Graph requests fail. The vulnerability involves incomplete masking of authentication tokens in logs. Only the first part of the JWT token is hidden, leaving the rest visible in plain text. This exposes sensitive claims like account scope, tenant, or timing, which could help reconstruct the full token while it is still valid.

Detection Guidance

Check Zammad logs for Microsoft Graph authentication token exposure. Look for partial JWT tokens in log files where masking was incomplete. Verify if logs contain sensitive claims like account scope or tenant details.

Impact Analysis

A Zammad admin with Microsoft Graph channel access could view logs and see partial tokens. This may lead to exposure of sensitive information such as account details or token claims. Attackers could use this information to reconstruct the full token while it is still valid, potentially gaining unauthorized access to systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of authentication tokens may result in data breaches, triggering compliance violations and potential legal consequences for organizations handling protected information.

Mitigation Strategies

Upgrade Zammad to version 7.1.2 or later to fix the token masking issue. Review and sanitize existing logs to remove any exposed tokens. Restrict access to logs containing sensitive authentication data.

Hi! I’m here to help you understand CVE-2026-63208. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70