OTRS GmbH (former OTRS AG) vulnerabilities
We track 3 vulnerabilities in OTRS GmbH (former OTRS AG) products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2026.
Latest OTRS GmbH (former OTRS AG) vulnerabilities
- 9.4 Critical severity
OTRS: Authentication Bypass by Spoofing
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to
- 9.1 Critical severity
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or…
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approxi
- 8.7 High severity
OTRS: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerab