CVE-2026-78357

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X OTRS versions 8.0.X OTRS versions 2023.X OTRS versions 2024.X OTRS versions 2025.X OTRS versions prior to 2026.7.X

Description Authentication tokens are not immediately invalidated when an agent or customer user account is deactivated or the password is changed. This allows a previously obtained JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—to remain valid until its expiration, which can be approximately 16 hours. An attacker possessing such a token can maintain access to the system with the privileges of the affected account. The impact depends on the token's permissions, ranging from limited customer account access to broader ticket, customer, or administrative functionality for agent tokens.

Recommendations Update OTRS versions 7.0.X to a fixed version. Update OTRS versions 8.0.X to a fixed version. Update OTRS versions 2023.X to a fixed version. Update OTRS versions 2024.X to a fixed version. Update OTRS versions 2025.X to a fixed version. Update OTRS versions prior to 2026.7.X to version 2026.7.X or later.