CVE-2026-63208 Details

A vulnerability in Zammad, a web-based open-source helpdesk and customer support system, prior to version 7.1.2, allows for the partial exposure of OAuth access tokens in error logs. When a Microsoft Graph request fails, Zammad logs the error along with the authentication token used to access the mailbox. Although the system attempts to mask this token, the masking is incomplete. For tokens in the JWT format, only the first part is hidden, leaving the remaining parts readable in plain text. This partial token can reveal sensitive information such as account scope, tenant details, and timing, potentially aiding in the reconstruction of the full token while it remains valid. Zammad administrators with access to the Microsoft Graph channel can view these logs and exploit this vulnerability.

Users can upgrade to Zammad version 7.1.2 or later, where this vulnerability has been fixed.