CVE-2026-63208: Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the token format Microsoft uses (JWT), only the first part is hidden, while the remaining parts remain readable in plain text. A Zammad admin with Microsoft Graph channel access can view these logs and see the partial token, which may reveal sensitive claims such as the account scope, tenant, or timing, and could assist in reconstructing the full token while it is still valid. This issue is fixed in version 7.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zammadto a version that resolves this vulnerability.Fixed in 7.1.2
Event History
Frequently Asked Questions
Who can view the exposed token material?
A Zammad administrator with access to the Microsoft Graph channel can view the affected error logs. The issue is relevant where Microsoft Graph mailbox requests fail and their errors are logged.
What information remains visible despite masking?
For Microsoft JWT access tokens, only the first part is hidden. The remaining token parts can remain readable in plain text and may reveal claims such as account scope, tenant, or timing.
Which versions are affected and what is the remediation?
Versions prior to 7.1.2 are affected. Upgrade Zammad to version 7.1.2.
How can an organization determine whether it may have been exposed?
Review Microsoft Graph request error logs accessible to Zammad administrators for partially masked JWT token values. Exposure is possible when failed Microsoft Graph requests caused these errors to be logged.