← Back to the live CVE advisory feed

CVE-2026-78357: OTRS

Severity

9.1 (CRITICAL)

Vendor

OTRS

Affected versions

Before 2026.7.X

Fixed version

2026.7.X

Patch status

Patched

Published

2026-10-12T07:16:37.073

Why it matters

This matters because the issue affects identity or token handling. Successful exploitation could allow unauthorized authentication, client manipulation, or access to protected services.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.

Technical summary

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivated or the user's password has been changed. The vulnerability does not allow an attacker to obtain authentication tokens by itself. Exploitation requires possession of a previously issued and still valid token. The actual impact depends on the privileges associated with the compromised token. Customer user tokens are limited to the permissions of the affected customer account, while agent tokens may provide access to broader ticket, customer, or administrative functionality depending on the assigned permissions. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

View the official NVD record for CVE-2026-78357

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.