OTRS Critical Flaw Lets Attacker Use Valid Tokens After Account Deactivation

OTRS contains a critical authentication flaw that fails to invalidate tokens when user accounts are deactivated or passwords are changed. According to the National Vulnerability Database record for CVE-2026-78357, this issue allows attackers to maintain access using existing JSON Web Tokens until their natural expiration.

The vulnerability, assigned a CVSS score of 9.1, stems from the system's failure to immediately revoke authentication credentials during account modifications. Previously issued tokens remain valid for approximately 16 hours, the standard expiration time for these sessions. This persistence allows an attacker who has already obtained a valid token to continue accessing the system with the privileges of the affected agent or customer user.

Technical Context and Impact

The weakness is classified under CWE-613, which relates to improper handling of authentication tokens. The National Vulnerability Database notes that the flaw does not enable attackers to steal or generate new tokens on its own. Exploitation strictly requires possession of a previously issued and still valid token, meaning the attacker must have already compromised the session or obtained the credential through other means.

The actual impact of the breach depends entirely on the privileges associated with the compromised token. Customer user tokens are limited to the specific permissions of that customer account, restricting the attacker's reach. However, agent tokens may provide access to broader functionalities, including ticket management, customer data, or administrative features, depending on the permissions assigned to that specific agent role.

Affected Versions

This issue affects multiple versions of the OTRS helpdesk software produced by OTRS GmbH, formerly known as OTRS AG. The National Vulnerability Database lists the following versions as affected: 7.0.X, 8.0.X, 2023.X, 2024.X, and 2025.X. Additionally, versions in the 2026.X series are vulnerable up to, but not including, version 2026.7.X. Organizations running any of these releases should verify their current version against this list to determine exposure.

What should you do?

Security teams should immediately audit their OTRS installations to determine if they are running any of the affected versions listed in the CVE record. Since no fix has been confirmed yet in the source material, organizations should monitor vendor communications closely for updates. Administrators should review active sessions and consider implementing stricter token expiration policies where possible to reduce the window of opportunity for attackers who may have obtained valid tokens.