CVE Intelligence
Analysis AI-assisted

CVE-2026-78357: OTRS: JWT tokens stay valid after account deactivation or password change (CWE-613)

OTRS does not immediately revoke previously issued JWT authentication tokens when an agent or customer user account is deactivated or its password is changed. A token may stay valid until normal expiry, roughly 16 hours, so anyone already holding it keeps that user's access. The CNA rates the issue 9.1 (critical) under CVSS 3.1, and it affects OTRS 7.0.x through 2026.x releases before 2026.7.x.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-78357 is an insufficient session expiration weakness (CWE-613) in OTRS, reported by OTRS as CNA. When an agent or customer user account is deactivated, or when the user's password is changed, JWT authentication tokens that were already issued are not invalidated right away. They remain usable until their regular expiry, which the vendor says can be approximately 16 hours.

Impact

Anyone who already holds a valid token can keep using OTRS with the affected user's privileges after the account has been disabled or the password reset. This undermines a standard incident response step: locking out a compromised or departing user does not end their existing sessions.

  • Customer user tokens are limited to the permissions of that customer account.
  • Agent tokens may expose broader ticket, customer or administrative functions, depending on assigned permissions.

The flaw does not let an attacker obtain tokens by itself. A previously issued, still-valid token is required. The CNA scored the issue 9.1 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. That vector says no privileges are required. It is reasonable to treat the real-world risk as dependent on how likely token theft or insider retention is in your environment.

Affected products and versions

According to the CVE record, OTRS (OTRS GmbH, formerly OTRS AG) is affected in:

  • 7.0.x
  • 8.0.x
  • 2023.x
  • 2024.x
  • 2025.x
  • 2026.x up to and including 2026.6.x

The description says 2026.x releases "before 2026.7.X" are affected. This suggests 2026.7.x is the first unaffected line, but the record lists no explicit fixed version.

Exploitation status

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. EPSS estimates a probability of about 0.3% (percentile around 21%) as of 2026-10-13.

Remediation and mitigation

  • Review the vendor advisory OTRS Security Advisory 2026-14 and upgrade to the release it designates as fixed. Based on the affected range, a 2026.7.x release is the likely target.
  • Older lines (7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x) appear in the affected list. Check the advisory for their upgrade path.
  • Until patched, assume a disabled account may keep access for up to about 16 hours. When responding to a compromise, consider additional containment, such as restricting network access to the OTRS instance or rotating signing secrets if your deployment supports it. Do this only according to vendor guidance.
  • Minimise agent permissions so that a stolen token has limited reach.

Detection guidance

  • After deactivating an account or resetting a password, monitor OTRS access and application logs for continued activity tied to that user.
  • Watch for API or web requests from unusual IP addresses or user agents using existing sessions.
  • Correlate HR offboarding and incident response timelines with OTRS activity during the roughly 16-hour token lifetime.

Limitations of the available information

  • The record lists no explicit fixed version or patch details beyond the vendor advisory link.
  • The NVD status is "Received". The NVD had not published its own analysis, and only the CNA's CVSS score is available.
  • The record does not say whether token lifetime is configurable or whether any workaround exists.

Frequently asked questions

Can an attacker use this flaw to steal OTRS tokens?

No. According to the vendor, the flaw does not by itself let an attacker obtain tokens. It only lets an already-held, still-valid token keep working after account deactivation or a password change.

How long can a revoked user keep access?

Until the token's regular expiration, which the vendor says can be approximately 16 hours.

Is CVE-2026-78357 being exploited?

It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which version fixes the issue?

The record lists 2026.x releases before 2026.7.x as affected, which suggests 2026.7.x is unaffected. No explicit fixed version is given, so check OTRS Security Advisory 2026-14.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.