{"metadata": {"vulnerability": "CVE-2026-78357", "count": 21, "kinds": {"milestone": 5, "sighting": 9, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-08-24T11:29:41.427Z", "date_only": false, "value": "2026-08-24T11:29:41.427Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-78357", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T06:49:10.919Z", "date_only": false, "value": "2026-10-12T06:49:10.919Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-78357", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T06:49:10.919Z", "date_only": false, "value": "2026-10-12T06:49:10.919Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-78357", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-12T06:49:10.919Z", "date_only": false, "value": "2026-10-12T06:49:10.919Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / OTRS", "record": "CVE-2026-78357", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T07:00:00Z", "date_only": false, "value": "2026-10-12T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / OTRS", "record": "CVE-2026-78357", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T07:04:03.860Z", "date_only": false, "value": "2026-10-12T07:04:03.860594Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117426660528782128", "record": "CVE-2026-78357", "field": "creation_timestamp", "uuid": "b6dc5afb-7c92-42e2-9e95-7aa4348f51d9", "content": "CVE-2026-78357 Insufficient Session Revocation for JWT Authentication Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours.\nAn attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivated or the user's password has been changed.\nThe vulnerability does not allow an attacker to obtain authentication tokens by itself. Exploitation requires possession of a previously issued and still valid token. The actual impact depends on the privileges associated with the compromised token. Customer user tokens are limited to the permissions of the affected customer account, while agent tokens may provide access to broader ticket, customer, or administrative functionality depending on the assigned permissions.\nThis issue affects OTRS:\n  *  7.0.X  *  8.0.X  *  2023.X  *  2024.X  *  2025.X  *  2026.X before 2026.7.X\nhttps://www.cve.org/CVERecord?id=CVE-2026-78357https://otrs.com/release-notes/otrs-security-advisory-2026-14/#otrs #OTRSGmbH(formerOTRSAG) #OTRS#CVE_2026_78357#bot", "url": "https://infosec.exchange/users/cve/statuses/117426660528782128"}, {"timestamp": "2026-10-12T07:16:37Z", "date_only": false, "value": "2026-10-12T07:16:37Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F6JH-P427-PJQ6", "record": "GHSA-F6JH-P427-PJQ6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T07:16:37.073Z", "date_only": false, "value": "2026-10-12T07:16:37.073", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-78357", "record": "FKIE_CVE-2026-78357", "field": "published"}, {"timestamp": "2026-10-12T07:16:37.073Z", "date_only": false, "value": "2026-10-12T07:16:37.073", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-78357", "record": "FKIE_CVE-2026-78357", "field": "lastModified"}, {"timestamp": "2026-10-12T08:00:06.790Z", "date_only": false, "value": "2026-10-12T08:00:06.790841Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxo2f22xfr2w", "record": "CVE-2026-78357", "field": "creation_timestamp", "uuid": "e5b01414-0655-4031-86f0-fba43d9387ba", "content": "CVE-2026-78357\nIf a staff or customer account in OTRS is turned off or its password is changed, any login token that was issued before that change can keep working for up to about 16 hours. This means someone who already has\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxo2f22xfr2w"}, {"timestamp": "2026-10-12T08:04:06.171Z", "date_only": false, "value": "2026-10-12T08:04:06.171435Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxo2m6esw72a", "record": "CVE-2026-78357", "field": "creation_timestamp", "uuid": "cc9b4f14-6265-473f-9799-c94cccfc0d74", "content": "\ud83d\udd34 CVE-2026-78357 - Critical (9.1)\n\nPreviously issued authentication tokens are not immediately invalidated when an OTRS agent or cus...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-78357/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxo2m6esw72a"}, {"timestamp": "2026-10-12T08:07:18.085Z", "date_only": false, "value": "2026-10-12T08:07:18.085047Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxo2rvx7dv2o", "record": "CVE-2026-78357", "field": "creation_timestamp", "uuid": "2a16587f-33b9-46b6-894d-fe1c8f909628", "content": "\ud83d\udea8 CVE-2026-78357 \u2014 CVSS 9.1 CRITICAL\n\nPreviously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-78357\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxo2rvx7dv2o"}, {"timestamp": "2026-10-12T08:10:11.459Z", "date_only": false, "value": "2026-10-12T08:10:11.459259Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/cm54ynm56y27g", "record": "CVE-2026-78357", "field": "creation_timestamp", "uuid": "7253d203-f22e-4e3b-b63a-0956f6f024e5", "content": "CVE-2026-78357 - Insufficient Session Revocation for JWT Authentication\nCVE ID : CVE-2026-78357\n \n Published : Oct. 12, 2026, 7:16 a.m. | 15\u00a0minutes ago\n \n Description : Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/cm54ynm56y27g"}, {"timestamp": "2026-10-12T09:00:30.113Z", "date_only": false, "value": "2026-10-12T09:00:30.113592Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117427118356349645", "record": "cve-2026-78357", "field": "creation_timestamp", "uuid": "56cd4ea1-b1cb-42df-9905-38199a5e140e", "content": "CVE-2026-78357: CRITICAL OTRS flaw (CVSS 9.1) lets compromised tokens stay valid up to 16h after account deactivation or password change. Affects 7.x, 8.x, 2023-2026.x versions. Patch status TBD \u2014 monitor token activity. https://radar.offseq.com/threat/cve-2026-78357-cwe-613-insufficient-session-expiration-in-otrs-gmbh-former-otrs-ag-otrs-e1496f2a7247a665 #OffSeq #OTRS #vuln #infosec", "url": "https://infosec.exchange/users/offseq/statuses/117427118356349645"}, {"timestamp": "2026-10-12T09:00:32.708Z", "date_only": false, "value": "2026-10-12T09:00:32.708627Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxo5r3m5lt23", "record": "cve-2026-78357", "field": "creation_timestamp", "uuid": "2ef0a257-5774-4872-bfe3-ea3a79543a06", "content": "OTRS CRITICAL vuln (CVE-2026-78357): Auth tokens stay valid up to 16h after account deactivation or password change. Patch status unknown \u2014 monitor token use and reduce token lifespan where possible. https://radar.offseq.com/threat/cve-2026-78357-cwe-613-insufficient-session-expiration-in-otrs-gm...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxo5r3m5lt23"}, {"timestamp": "2026-10-12T09:31:21Z", "date_only": false, "value": "2026-10-12T09:31:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F6JH-P427-PJQ6", "record": "GHSA-F6JH-P427-PJQ6", "field": "published"}, {"timestamp": "2026-10-12T09:31:21Z", "date_only": false, "value": "2026-10-12T09:31:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F6JH-P427-PJQ6", "record": "GHSA-F6JH-P427-PJQ6", "field": "modified"}, {"timestamp": "2026-10-12T18:15:47.508Z", "date_only": false, "value": "2026-10-12T18:15:47.508379Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxp4rx4vps2h", "record": "CVE-2026-78357", "field": "creation_timestamp", "uuid": "efa85d38-57d8-462c-b321-f9e2558976d6", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-102255 \u00b7 10 people\n2. CVE-2026-85097 \u00b7 8 people\n3. CVE-2026-97229 \u00b7 7 people\n4. CVE-2026-78357 \u00b7 5 people\n5. CVE-2026-93582 \u00b7 5 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxp4rx4vps2h"}, {"timestamp": "2026-10-12T18:15:49.259Z", "date_only": false, "value": "2026-10-12T18:15:49.259401Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxp4rxdqhs2h", "record": "CVE-2026-78357", "field": "creation_timestamp", "uuid": "f7c80445-34d7-4044-b5ef-885d2b20ca7f", "content": "4. CVE-2026-78357 \u00b7 5 people\n\ud83d\udfe5 Critical 9.1 \u00b7 OTRS\n\nInsufficient Session Revocation for JWT Authentication", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxp4rxdqhs2h"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-78357", "record": "UBUNTU-CVE-2026-78357", "field": "published"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-78357", "record": "UBUNTU-CVE-2026-78357", "field": "modified"}]}