CVE-2026-78357
Received Received - Intake

Authentication Token Persistence in OTRS

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: OTRS AG

Description
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivated or the user's password has been changed. The vulnerability does not allow an attacker to obtain authentication tokens by itself. Exploitation requires possession of a previously issued and still valid token. The actual impact depends on the privileges associated with the compromised token. Customer user tokens are limited to the permissions of the affected customer account, while agent tokens may provide access to broader ticket, customer, or administrative functionality depending on the assigned permissions. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-78357
EUVD
EUVD-2026-97267

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
OTRS GmbH (former OTRS AG) OTRS 7.0.x
OTRS GmbH (former OTRS AG) OTRS 8.0.x
OTRS GmbH (former OTRS AG) OTRS 2023.x
OTRS GmbH (former OTRS AG) OTRS 2024.x
OTRS GmbH (former OTRS AG) OTRS 2025.x
OTRS GmbH (former OTRS AG) OTRS 2026.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves authentication tokens (JWT) not being invalidated immediately when an OTRS agent or customer user account is deactivated or their password is changed. This allows a previously obtained valid token to remain active for up to approximately 16 hours, potentially granting continued access to the system with the user's privileges.

Detection Guidance

Detecting this vulnerability requires checking for active JWT tokens after account deactivation or password changes. Monitor logs for unusual activity from previously deactivated accounts. Check token expiration times in your OTRS logs or database. Review all active sessions for accounts that should no longer have access.

Impact Analysis

If an attacker has already stolen a valid token, they can use it to access OTRS with the privileges of the affected user. Customer tokens are limited to the user's permissions, but agent tokens may allow broader access to tickets, customer data, or administrative functions depending on assigned permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles and HIPAA's access controls. Unauthorized access via compromised tokens may result in data breaches, non-compliance with data retention and access requirements, and increased risk of regulatory penalties.

Mitigation Strategies

Immediately update OTRS to version 2026.7.1 or later. Revoke all existing JWT tokens by restarting the OTRS service. Force password resets for all users, especially agents. Monitor for unauthorized access attempts during the transition period.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78357. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart