OTRS CVE-2026-78357

Exploitation requires the attacker to already possess a previously issued, still-valid OTRS authentication JWT; the flaw itself provides no way to obtain a token. The exploitable window opens when the associated agent or customer account is deactivated or its password is changed, and lasts only until the token's normal expiration (approximately 16 hours). Impact is limited by the privileges tied to the specific token: customer-user tokens are confined to that customer account, while agent tokens may reach broader ticket, customer, or administrative functions depending on assigned permissions. The key limiting factors are prior token possession and the finite token lifetime - there is no persistence beyond expiry.

The input assigns CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but this score conflicts with the description and should be treated with caution: the vector claims PR:N (no privileges), yet the description explicitly states 'Exploitation requires possession of a previously issued and still valid token' and 'The vulnerability does not allow an attacker to obtain authentication tokens by itself.' That is a prerequisite the PR:N metric does not capture - realistically this is a privileged/insider or token-theft scenario (CWE-613, insufficient session expiration), not a true unauthenticated network compromise, so the 9.1 overstates real-world ease of attack. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The practical risk is bounded: the attacker must already hold a valid token, the window is limited to the token's remaining lifetime (up to ~16 hours), and impact depends on whether the token is a limited customer-user token or a broader agent/admin token. Net assessment: a legitimate security hardening issue most relevant to deprovisioning and post-compromise response (deactivated employees, forced password resets after suspected compromise), but lower immediate mass-exploitation risk than the headline 9.1 implies.

A former OTRS agent whose account is deactivated - or a user whose password was reset after a suspected compromise - reuses their still-valid JWT to keep accessing OTRS for up to roughly 16 hours, viewing or modifying tickets and customer data with the original account's privileges. No public exploit code is referenced for this issue. The attack only works because the attacker already possesses a previously issued, non-expired token.