Read the docs
TI-2026-15098 Aliases CVE-2026-18363GHSA-h2gf-gwxr-4pm4

Weak password recovery mechanism in osTicket by Enhancesoft LLC

Priority MEDIUM 42CWE-640Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired. Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the intended expiry validation. Therefore, an attacker able to obtain a valid password reset token could reuse it to perform an unauthorised password reset and compromise the affected account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00478 41st percentileScored 2026-11-07
Fix Fixed osTicket (Enhancesoft LLC): 1.17.8, 1.18.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EnhancesoftosTicketbefore 1.17.8; before 1.18.41.17.8, 1.18.4Patch availableCNA
  • osTicket VendorEnhancesoft Affected before 1.17.8; before 1.18.4 Fixed in 1.17.8, 1.18.4 Patch available CNA

Remediation

  • Fix · CNA osTicket (Enhancesoft LLC) Fixed in 1.17.8, 1.18.4

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-18363
  2. 2026-10-03 Alias added: GHSA-h2gf-gwxr-4pm4

References

Patch 1

  • TI-2026-17810 osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read CVSS 4.0HIGH 8.7
  • TI-2022-13729 SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before… CVSS 3.1CRITICAL 9.8
  • TI-2020-15225 SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. CVSS 3.1CRITICAL 9.8
  • TI-2022-13727 Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. CVSS 3.1HIGH 8.8
  • TI-2025-19272 A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in… CVSS 3.1MEDIUM 6.5
  • TI-2023-14123 A denial of service attack might be launched against the server if an unusually lengthy… CVSS 3.1HIGH 7.5
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences