CVE-2026-38447
Received Received - Intake

Predictable API Key Generation in osTicket

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: MITRE

Description
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-38447
EUVD
EUVD-2026-52402

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
osticket osticket 1.18.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-331 The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in osTicket 1.18.3 involves predictable API key generation due to the use of MD5 hashing with predictable inputs like timestamps and client IP addresses. This reduces key entropy, allowing attackers to estimate generation time and brute-force the key space within a feasible window.

Detection Guidance

To detect this vulnerability, check for API keys generated in osTicket 1.18.3 that use predictable MD5 hashing based on timestamp and client IP. Review logs for API key generation patterns and verify if keys were created with insufficient entropy. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to gain unauthorized access to osTicket systems, intercept sensitive data, or perform actions on behalf of legitimate users. This could lead to data breaches, unauthorized modifications, or service disruption.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by enabling unauthorized access to personal or health data. Organizations may face legal penalties, reputational damage, and mandatory breach notifications if exploited.

Mitigation Strategies

Upgrade osTicket to a version that does not use MD5 for API key generation. Review and rotate all existing API keys to prevent potential unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-38447. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart