The vulnerability resides in Zammad’s handling of Microsoft Graph request failures. When a request fails, the system logs the authentication OAuth token; the masking routine only masks the first part of the JWT, leaving the remaining segments readable. The exposed token fragments may contain sensitive claims such as account scope, tenant, and timestamps, which can aid an attacker in reconstructing the full token during its validity period. The core weakness is insufficient sanitization of authentication credentials before logging.

Zammad versions earlier than 7.1.2 are affected. The issue appears in the Zammad web‑based helpdesk platform used by organizations to support customer queries. Any deployment of Zammad below the fixed version that integrates with Microsoft Graph continues to log incomplete token information.

The CVSS score of 5.1 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an administrator with access to the Microsoft Graph integration channel who can view system logs. If an attacker can gain such internal privileges or intercept logs, they could recover full tokens and potentially gain unauthorized Microsoft Graph access. Because the token fragment remains partially exposed, defenders should consider the risk of credential leakage and potential token resurrection.