This is a flaw in OTRS that allows a previously issued JSON Web Token (JWT) to remain valid after its associated user account is either deactivated or its password changed. Because the token is not revoked immediately, an attacker who already holds a valid token can continue to use that token to access OTRS services for up to the token’s remaining lifetime—potentially 16 hours. The impact depends on the token’s privileges: an agent token could grant broader ticket or administrative access, while a customer token is confined to the customer’s own permissions. The vulnerability does not grant new tokens; it only affords extended use of an existing one.

The vulnerability affects OTRS from OTRS GmbH. Versions impacted include 7.0.X, 8.0.X, and the 2023, 2024, 2025 and 2026 line releases up to but excluding 2026.7.X. The vendor’s fix is to upgrade to OTRS 2026.7.1 or any later release.

The CVSS score of 9.1 classifies this issue as high severity. EPSS data is not available, but a prolonged exploitation window exists because a valid token can stay active for many hours. Exploitation requires an attacker to have received a legitimate token beforehand, typically via prior compromise or credential theft; once obtained, the token can be used for unauthorized access until it expires or until the account is revived again. The vulnerability is not listed in CISA’s KEV catalog, yet the potential for extended unauthorized access warrants treating the issue as a critical risk, especially in environments with long token lifetimes.