CVE-2026-18363: osTicket Auth Bypass Vulnerability

CVE-2026-18363 Overview

CVE-2026-18363 is a logic flaw in the password reset token validation routine of osTicket, an open-source support ticketing system maintained by Enhancesoft LLC. The vulnerability affects osTicket versions prior to v1.17.8 and v1.18.4. During password reset, the application retrieves the timestamp associated with the supplied token and evaluates whether the configured validity window has elapsed. The expiry check runs only when the timestamp lookup fails, so any token with an existing timestamp bypasses the intended expiry validation. An attacker who obtains a valid password reset token can reuse it indefinitely to hijack the associated account. The issue is categorized under CWE-640: Weak Password Recovery Mechanism for Forgotten Password.

Critical Impact
Attackers who acquire a valid password reset token can reuse it past the intended expiry window to perform an unauthorized password reset and take over the affected osTicket account.

Affected Products

osTicket versions prior to v1.17.8
osTicket versions prior to v1.18.4
Vendor: Enhancesoft LLC

Discovery Timeline

2026-07-30 - CVE-2026-18363 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18363

Vulnerability Analysis

The defect resides in the password reset workflow used by osTicket to authenticate a token before allowing a credential change. The routine performs two operations in sequence: it looks up the timestamp associated with the supplied token, then evaluates whether the current time falls outside the configured validity period. The evaluation branch is inverted in effect. The expiry comparison executes only if the timestamp lookup does not return a value. When the lookup succeeds, the code path skips the expiry comparison and treats the token as valid regardless of age. This is a classic logic error in an authentication-adjacent workflow rather than a memory or injection defect.

Root Cause

The root cause is control-flow error in the token validation function. The expiry check is gated on the failure of the timestamp lookup instead of running unconditionally after a successful lookup. As a result, the intended time-based invalidation of reset tokens never triggers for legitimate, database-backed tokens. The weakness maps to CWE-640, which covers weak password recovery mechanisms where a recovery artifact does not enforce the security properties required to protect an account.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction beyond acquiring a reset token. An attacker who intercepts, exfiltrates from logs, or otherwise obtains a valid reset token can submit it to the reset endpoint at any later time. The application accepts the token, permits selection of a new password, and returns control of the account. Impact includes confidentiality and integrity loss on the compromised osTicket account, which for administrative users can extend to ticket data, embedded attachments, and connected mail credentials. See the INCIBE advisory for the coordinated disclosure record.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in prose above; refer to the vendor patch commits in v1.17.8 and v1.18.4 for the corrected validation logic.

Detection Methods for CVE-2026-18363

Indicators of Compromise

Successful password reset events for an account where the associated reset token was issued outside the configured validity window.
Multiple password reset completions for the same account using the same token value across different sessions or source addresses.
Account login activity from new geolocations or user-agent strings shortly after a password reset event.
Administrator or agent account password changes not correlated with a helpdesk request or ticket audit entry.

Detection Strategies

Instrument the osTicket reset endpoint to log token issuance time, token use time, and the delta between them, then alert when the delta exceeds the configured validity window.
Correlate pwreset.php request logs with the ost_config reset-token TTL setting to surface stale-token acceptance.
Baseline reset volume per account and per source IP, and flag repeated resets targeting privileged osTicket agents or administrators.

Monitoring Recommendations

Forward osTicket web server access logs and application audit logs to a centralized analytics platform for retention and correlation.
Monitor outbound mail queues for password reset messages to spot enumeration campaigns against user accounts.
Track privileged-account authentication events after any observed reset to identify follow-on abuse of hijacked credentials.

How to Mitigate CVE-2026-18363

Immediate Actions Required

Upgrade osTicket to v1.17.8 or v1.18.4 (or later) on all production and staging instances.
Invalidate all outstanding password reset tokens by clearing the relevant token store after upgrade.
Force password rotation for administrator and agent accounts that were active before the patch.
Review web and application logs for reset events involving tokens older than the configured validity period.

Patch Information

Enhancesoft LLC addressed CVE-2026-18363 in osTicket v1.17.8 and v1.18.4. The corrected code path enforces the expiry comparison whenever a token timestamp is retrieved, so aged tokens are rejected regardless of lookup outcome. Refer to the INCIBE notice on weak password recovery in osTicket for the coordinated disclosure record and vendor guidance.

Workarounds

Restrict access to the osTicket password reset endpoint behind a VPN or IP allowlist until patching is complete.
Reduce the configured reset token validity window to the shortest operationally viable value to limit reuse exposure.
Require multi-factor authentication for staff and administrator logins so that a password reset alone does not yield account access.

bash

# Verify installed osTicket version and confirm patched build
grep -R "THIS_VERSION" /var/www/osticket/include/class.osticket.php

# Example web server allowlist for the reset endpoint (nginx)
location = /pwreset.php {
    allow 10.0.0.0/8;
    deny all;
    include fastcgi_params;
}