What’s Vulnerable › Vulnerabilities

CVE-2020-1778: Bypassing user account validation

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-23 · updated 2026-06-17
• Weakness: CWE-287

Description

When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid. This issue affects OTRS; 8.0.9 and prior versions.

Affected products

• OTRS AG OTRS: through 8.0.9

References

• https://otrs.com/release-notes/otrs-security-advisory-2020-16/
• https://otrs.com/release-notes/otrs-security-advisory-2020-16/

Get alerted when CVE-2020-1778 or the next vulnerability affects your stack