CVE-2026-78357: CWE-613 Insufficient Session Expiration in OTRS GmbH (former OTRS AG) OTRS

This vulnerability (CWE-613 Insufficient Session Expiration) in OTRS occurs because authentication tokens (JWTs) are not immediately invalidated when an agent or customer user account is deactivated or its password is changed. Consequently, an attacker who has previously obtained a valid token can maintain access with the privileges of the affected user until the token expires naturally. The impact depends on the privileges of the compromised token, with agent tokens potentially granting broader access than customer tokens. The affected versions include OTRS 7.0.0 up to but not including 7.1.0, 8.0.0 up to but not including 8.1.0, and all 2023, 2024, 2025, and 2026 versions prior to 2026.7.X.

An attacker possessing a previously issued valid authentication token can continue to access OTRS with the privileges of the affected user even after that user's account is deactivated or their password changed. This can lead to unauthorized access to sensitive ticket, customer, or administrative functions depending on the token's privileges. The vulnerability does not allow token theft or generation by itself; exploitation requires prior token compromise. The token remains valid for approximately 16 hours after account changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider reducing token lifetime if configurable, monitor for unusual token usage, and ensure that tokens are protected from theft. Immediate invalidation of tokens upon account deactivation or password change is recommended once a patch is released.