CVE-2026-78357: Insufficient Session Revocation for JWT Authentication
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours.
An attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivated or the user's password has been changed.
The vulnerability does not allow an attacker to obtain authentication tokens by itself. Exploitation requires possession of a previously issued and still valid token. The actual impact depends on the privileges associated with the compromised token. Customer user tokens are limited to the permissions of the affected customer account, while agent tokens may provide access to broader ticket, customer, or administrative functionality depending on the assigned permissions.
This issue affects OTRS:
7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Who is exposed to continued access after an account is disabled or its password is changed?
Any deactivated agent or customer user whose JWT was previously obtained may remain accessible until that token reaches its normal expiration, which can be approximately 16 hours. The resulting access is limited by the permissions assigned to the affected account.
What does an attacker need to exploit this issue?
The attacker must already possess a valid, previously issued JWT for the affected agent or customer user. This issue does not itself provide a way to obtain authentication tokens.
Are all affected tokens equally impactful?
No. Customer user tokens are limited to the affected customer account's permissions, while agent tokens may allow broader ticket, customer, or administrative access depending on the agent's assigned permissions.
How long can a compromised token remain usable after revocation-related actions?
A previously issued token can remain valid until its regular expiration time, which can be approximately 16 hours. Deactivating the account or changing its password does not immediately invalidate that token.
Which OTRS releases are affected?
Affected releases are OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X.