OTRS: Insufficient session revocation for JWT authentication
Summary
Authentication tokens (JWTs) issued to OTRS agents and customer users remain valid after the account is deactivated or the password is changed, until their regular expiration of about 16 hours. An attacker who already holds a valid token can keep accessing OTRS with the privileges of that account during this period. Exploitation requires a previously issued, still valid token; the attacker cannot obtain tokens by this flaw alone. Impact depends on the account's permissions, and agent tokens may reach broader ticket, customer or administrative functions.
Affected
- OTRS 7.0.x
- OTRS 8.0.x
- OTRS 2023.x
- OTRS 2024.x
- OTRS 2025.x
- OTRS 2026.x up to and including 2026.6.x
Fixed in
- OTRS 2026.7.1 or later (per vendor advisory OSA-202026-14 and CNA record)
- OTRS 7: the CNA record indicates no patches will be released; confirm with OTRS directly
- Versions 8.0.x, 2023.x, 2024.x and 2025.x: no fixed release confirmed in the sources; treat as unpatched until the vendor confirms
Workaround
- No vendor-published workaround found.
- Generic option: shorten the JWT lifetime or implement custom revocation so tokens of deactivated accounts are invalidated quickly; test for side effects first.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not in CISA KEV; EPSS 0.00304.
- No public proof of concept or exploitation in the wild reported in the sources checked.
Our recommendation
- Check whether OTRS is in use and which version runs; determine if it is reachable from the internet.
- Upgrade to OTRS 2026.7.1 or later; for OTRS 7 and other unpatched branches, plan a migration or confirm vendor support status.
- Until patched, shorten JWT lifetime where feasible and review logs for activity by deactivated accounts or changed-password users in the last 16 hours.
- Revoke existing sessions and tokens for accounts that were disabled or whose password was changed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OTRS Security Advisory 2026-14 otrs.com
- OpenCVE: CVE-2026-78357 app.opencve.io
- VulDB: CVE-2026-78357 vuldb.com
- Vulners CVE record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:56.
Original description (NVD)
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivated or the user's password has been changed. The vulnerability does not allow an attacker to obtain authentication tokens by itself. Exploitation requires possession of a previously issued and still valid token. The actual impact depends on the privileges associated with the compromised token. Customer user tokens are limited to the permissions of the affected customer account, while agent tokens may provide access to broader ticket, customer, or administrative functionality depending on the assigned permissions. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.