Enhancesoft osTicket up to 1.17.7/1.18.3 Password Reset Token Validation password recovery

Summaryinfo

A vulnerability identified as critical has been detected in Enhancesoft osTicket up to 1.17.7/1.18.3. Impacted is an unknown function of the component Password Reset Token Validation. The manipulation leads to password recovery. This vulnerability is referenced as CVE-2026-18363. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Enhancesoft osTicket up to 1.17.7/1.18.3. It has been rated as critical. This issue affects some unknown functionality of the component Password Reset Token Validation. The manipulation with an unknown input leads to a password recovery vulnerability. Using CWE to declare the problem leads to CWE-640. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired. Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the intended expiry validation. Therefore, an attacker able to obtain a valid password reset token could reuse it to perform an unauthorised password reset and compromise the affected account.

The advisory is shared at incibe.es. The identification of this vulnerability is CVE-2026-18363 since 07/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1552 for this issue.

Upgrading to version 1.17.8 or 1.18.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51068). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Ticket Tracking Software

Vendor

• Enhancesoft

Name

• osTicket

Version

• 1.17.0
• 1.17.1
• 1.17.2
• 1.17.3
• 1.17.4
• 1.17.5
• 1.17.6
• 1.17.7
• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion