Pubblicato il 2026-10-12 · Fonte: NVD NIST
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivate
Vulnerabilità con punteggio CVSS 9.1 (CRITICAL). Sfruttata attivamente: No.
Vendor: N/A
Prodotti: N/A
Applicare le patch del vendor appena disponibili. Monitorare gli advisory ufficiali.
Vuoi approfondire la cybersecurity? Scopri il libro "Ethical Hacker per Tutti" oppure prenota una lezione online.