JWT Token Invalidation Delay in OTRS Authentication

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivated or the user's password has been changed. The vulnerability does not allow an attacker to obtain authentication tokens by itself. Exploitation requires possession of a previously issued and still valid token. The actual impact depends on the privileges associated with the compromised token. Customer user tokens are limited to the permissions of the affected customer account, while agent tokens may provide access to broader ticket, customer, or administrative functionality depending on the assi

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability affects OTRS (Open Ticket Request System) implementations where authentication tokens—specifically JWTs—remain valid long after user accounts are deactivated or passwords are changed. The core issue is a session management flaw where token revocation isn't enforced immediately, allowing attackers who previously compromised valid credentials to maintain unauthorized access for up to 16 hours. This is critical for organizations using OTRS for helpdesk operations, as attackers can impersonate legitimate agents or customers, potentially accessing sensitive tickets, customer data, and internal communications. Any organization running vulnerable OTRS versions faces significant risk, particularly in scenarios where employee accounts are terminated or compromised credentials are discovered.

Casky's 283 matching security skills—powered by Claude AI's extended reasoning—enable practitioners to detect attack patterns associated with TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners would observe findings related to: anomalous token usage from deactivated accounts, session persistence after password resets, and JWT tokens being replayed beyond expected lifecycle windows. The skills map to detection capabilities around improper session termination, token lifecycle management failures, and post-compromise persistence techniques. Practitioners analyzing OTRS logs and authentication events would see indicators such as successful API calls or ticket access occurring after documented account deactivation timestamps, or authentication events that don't correspond to current active users—patterns that reveal the delayed token invalidation window being actively exploited.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78357.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-78357

Casky has 283 skills that investigate the attack patterns behind CVE-2026-78357. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn