CVE-2026-78357 OTRS GmbH (former OTRS AG) CVE debrief

Who should care

OTRS administrators, security teams, and users with affected accounts should assess exposure and prioritize mitigation. This includes verifying OTRS version, deactivating or changing passwords of affected accounts, and invalidating existing JWT authentication tokens.

Why it matters

CVE-2026-78357 is a critical vulnerability in OTRS that allows an attacker with a valid JWT authentication token to maintain access even after the associated account is deactivated or the password is changed. OTRS administrators and security teams should prioritize verifying and mitigating this vulnerability, especially for OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X.

• An attacker can maintain unauthorized access to OTRS with the privileges of the compromised account.
• The vulnerability requires possession of a previously issued and still valid JWT authentication token.
• The actual impact depends on the privileges associated with the compromised token.
• Verification of OTRS version and affected instances is necessary.

Technical summary

CVE-2026-78357 is a critical vulnerability in OTRS, allowing an attacker with a previously obtained and still valid JWT authentication token to continue accessing OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivated or the user's password has been changed. The vulnerability requires possession of a previously issued and still valid token. The actual impact depends on the privileges associated with the compromised token. OTRS administrators and security teams should prioritize verifying and mitigating this vulnerability, especially for OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X.

Defensive priority

OTRS administrators and security teams should prioritize verifying and mitigating this vulnerability, especially for OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X.

Recommended defensive actions

• Verify OTRS version and check if it is vulnerable
• Deactivate or change passwords of affected agent or customer user accounts
• Invalidate existing JWT authentication tokens
• Upgrade to OTRS 2026.7.X or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is required to confirm affected versions and instances. OTRS GmbH (former OTRS AG) is listed as the affected vendor.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.