← Back to search

CVE-2026-78357

9.1 CRITICAL

Published 2026-10-12 · Updated 2026-10-15

AI risk analysis

Summary
OTRS authentication tokens remain valid even after user accounts are deactivated or passwords changed, allowing attackers with previously obtained tokens to maintain access for up to 16 hours beyond account changes. This creates a window where compromised credentials can be used long after they should have been revoked.
Exploitability
Exploitation requires possession of a previously issued valid JWT token and is moderately difficult as it depends on timing and the attacker's ability to maintain access to the stolen token until its natural expiration.
Blast radius
The impact varies by token type, with agent tokens potentially providing broad administrative access while customer tokens limit access to specific customer data, but both can enable persistent unauthorized access for up to 16 hours after account changes.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to OTRS 2026.7.X or later to receive the fix for this token invalidation vulnerability.
auth-bypassjwtaccess-control

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivated or the user's password has been changed. The vulnerability does not allow an attacker to obtain authentication tokens by itself. Exploitation requires possession of a previously issued and still valid token. The actual impact depends on the privileges associated with the compromised token. Customer user tokens are limited to the permissions of the affected customer account, while agent tokens may provide access to broader ticket, customer, or administrative functionality depending on the assigned permissions. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-613

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.