CVE-2026-18363
Received Received - Intake

Password Reset Token Logic Flaw in osTicket

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired. Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the intended expiry validation. Therefore, an attacker able to obtain a valid password reset token could reuse it to perform an unauthorised password reset and compromise the affected account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-18363
EUVD
EUVD-2026-51068

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
enhancesoft osticket to 1.18.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a logic vulnerability in osTicket's password reset token validation. When a user requests a password reset, the system checks if the token's timestamp has expired. However, due to flawed logic, tokens with valid timestamps bypass the expiry check, allowing attackers to reuse them for unauthorized password resets.

Detection Guidance

Check osTicket version using commands like 'grep -r "osticket" /var/www/html/' or 'cat /var/www/html/include/ost-config.php | grep "VERSION"'. If version is below v1.17.8 or v1.18.4, the system is vulnerable.

Impact Analysis

If you use osTicket versions prior to v1.17.8 or v1.18.4, an attacker could obtain a valid password reset token and reuse it to reset your account password without authorization, potentially gaining control of your account.

Compliance Impact

This vulnerability could lead to unauthorized access to user accounts, potentially exposing sensitive personal data. This may violate GDPR's data protection principles and HIPAA's safeguards for protected health information, depending on the data processed by the affected system.

Mitigation Strategies

Upgrade osTicket to v1.17.8 or v1.18.4 or later immediately. Review and revoke any active password reset tokens. Monitor for unauthorized account changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18363. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart