CVE-2026-18363
A logic flaw in osTicket’s password reset process lets attackers reuse a valid token to reset a password. The flaw occurs because the expiry check is only performed when the token’s timestamp lookup fails. As a result, any valid token can be abused to compromise an account.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
osTicket versions prior to 1.17.8 and 1.18.4. Users of those versions, typically administrators and end users of the ticketing system.
Real-world impact
An attacker who obtains a valid password reset token can reuse it to reset the account password, gaining unauthorized access to the account.
Why this severity
The CVSS score of 9.1 reflects that the flaw allows an unauthenticated attacker to bypass the token expiry check, giving them full control over the account without needing any other credentials. The high confidentiality impact and lack of required privileges make it a critical issue.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources