Key points
- Authentication tokens persist until natural expiration, roughly 16 hours, despite account changes.
- The flaw affects OTRS versions 7.0 through 2025 and early 2026 releases.
- Attackers need a previously stolen token to exploit the weakness; no new token generation is required.
Organisations running OTRS must treat stolen authentication tokens as persistent threats until those tokens naturally expire. The National Vulnerability Database lists CVE-2026-78357 as a critical flaw with a CVSS score of 9.1. This rating reflects the high risk that attackers can maintain access to support systems even after administrators attempt to lock them out by deactivating accounts or resetting passwords.
The vulnerability stems from how OTRS handles JSON Web Tokens (JWTs). When an agent or customer account is disabled or its password is changed, the system does not immediately invalidate existing tokens. Instead, these credentials remain usable until their standard expiration time arrives. According to the NVD record, this window can last approximately 16 hours, giving attackers a significant period to act with compromised privileges.
What we know
The NVD describes the issue under CWE-613, noting that previously issued tokens are not revoked upon account status changes. An attacker cannot use this flaw to generate new tokens on their own. Exploitation requires that the threat actor has already obtained a valid authentication token through other means. Once in possession of such a token, the attacker can continue accessing the OTRS platform regardless of subsequent administrative actions like deactivation.
The impact varies based on the type of account compromised. Customer user tokens are restricted to the permissions of that specific customer account. In contrast, agent tokens may grant access to broader functionalities, including ticket management, customer data, or administrative features, depending on the role assigned to the agent. This distinction is critical for risk assessment, as high-privilege agent tokens pose a greater operational threat.
OTRS GmbH, formerly OTRS AG, confirms the vulnerability affects multiple release lines. Specifically, OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, and 2025.X are vulnerable. Additionally, the 2026.X series is affected in all versions prior to 2026.7.X. Organizations should verify their current installation against this list to determine exposure.
Defender's checklist
- Identify all OTRS installations running versions 7.0 through 2025.
- Check 2026.X installations for versions earlier than 2026.7.X.
- Review logs for unusual activity during the 16-hour token validity window.
- Assess the privilege levels of any compromised agent or customer accounts.
What to do and how to stay safe: OTRS
- Monitor active sessions closely and force re-authentication where possible.
- Limit the token expiration duration in system configurations to reduce the window.
- Implement strict access controls for administrative and agent accounts.
- Watch for anomalous access patterns that may indicate token reuse.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can an attacker create a new token using this vulnerability?
No, the flaw only allows reuse of previously issued tokens; it does not enable new token generation.
Which OTRS versions are affected by CVE-2026-78357?
Versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X are affected.
How long do tokens remain valid after account deactivation?
Tokens remain valid until their regular expiration time, which can be approximately 16 hours.
