Key points
- CVE-2026-78357 carries a CVSS score of 9.1, classifying it as a critical severity issue.
- Authentication tokens remain valid for up to 16 hours after account deactivation or password changes.
- Affected versions include OTRS 7.0.X through 2025.X and 2026.X prior to 2026.7.X.
The short version
- Attackers possessing valid JWTs can bypass account deactivation controls in vulnerable OTRS systems.
- The flaw does not enable new token theft but extends the lifespan of previously stolen credentials.
- OTRS GmbH has identified the issue across multiple major product lines, including recent releases.
The details
Organisations using OTRS ticketing systems face a critical risk from a vulnerability that fails to invalidate authentication tokens promptly. According to the National Vulnerability Database record for CVE-2026-78357, the flaw carries a CVSS score of 9.1, indicating severe potential impact. The core issue lies in how the system handles session management during account status changes. When an administrator deactivates an agent or customer account, or when a user changes their password, the system does not immediately revoke existing authentication tokens.
This delay allows previously issued JSON Web Tokens to remain functional until their scheduled expiration time. The source material notes that this window can last approximately 16 hours. During this period, any party in possession of a valid token retains full access to the account. This behaviour persists regardless of whether the underlying account has been disabled or its credentials altered, creating a significant gap in defensive controls.
The context
The vulnerability does not provide a mechanism for attackers to generate or steal new authentication tokens. Exploitation strictly requires possession of a token that was previously issued and remains within its validity period. This constraint shapes the threat landscape, making the risk contingent on prior credential compromise. Attackers must have already obtained a valid token through other means, such as phishing, malware, or network interception, before they can leverage this specific flaw.
The actual damage an attacker can inflict depends entirely on the privileges associated with the compromised token. Customer user tokens are restricted to the permissions of that specific customer account. However, agent tokens may grant access to broader functionalities, including ticket management, customer data, or administrative features, depending on the role assigned to the agent. This means that compromised agent accounts pose a significantly higher risk to organisational security than compromised customer accounts.
Defender's checklist
Security teams should immediately audit their OTRS environments to determine if they are running affected versions. The vulnerability impacts OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, and 2025.X. It also affects 2026.X versions prior to 2026.7.X. Organisations using OTRS GmbH’s software should review their patching status against these version lists. Additionally, teams should monitor for unusual activity in accounts that have recently been deactivated or had passwords changed, as this may indicate exploitation of lingering tokens.
Background: Token theft
Token theft occurs when an adversary extracts valid authentication credentials from memory or network traffic. This process bypasses login screens and multi-factor authentication. You can interrupt it by enforcing short token lifespans, binding sessions to device characteristics, and monitoring for anomalous token usage patterns.
Read the full guide: How Token Theft Works: The Mechanics of Session Hijacking
What to do and how to stay safe: OTRS
- Review logs for access attempts from deactivated accounts or accounts with recently changed passwords to identify potential exploitation.
- Implement strict session management policies that enforce shorter token expiration times to reduce the window of opportunity for attackers.
- Monitor network traffic for signs of credential theft, as obtaining a valid token is a prerequisite for exploiting this vulnerability.
- Ensure all OTRS instances are updated to version 2026.7.X or later once the vendor provides the necessary security patch.
Step-by-step guide: Unpatched Software: Why Missing Updates Create Hidden Entry Points
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability allow attackers to steal new authentication tokens?
No, the vulnerability does not enable the theft of new tokens. Attackers must already possess a valid, previously issued token to exploit the flaw.
How long does an attacker have to exploit a stolen token after account deactivation?
The token remains valid until its regular expiration time, which can be approximately 16 hours after the account is deactivated or the password is changed.
Which OTRS versions are affected by CVE-2026-78357?
The issue affects OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X versions prior to 2026.7.X.
