CVE-2026-26895: osTicket Information Disclosure Flaw

CVE-2026-26895 Overview

A user enumeration vulnerability exists in the /pwreset.php endpoint of osTicket v1.18.2. This security flaw allows remote attackers to enumerate valid usernames registered in the platform by analyzing response differences from the password reset functionality. This type of vulnerability (CWE-203: Observable Discrepancy) enables attackers to build a list of valid user accounts, which can then be targeted in subsequent attacks such as credential stuffing, password spraying, or phishing campaigns.

Critical Impact

Remote attackers can identify valid user accounts in osTicket deployments without authentication, enabling targeted attacks against known users.

Affected Products

• osTicket v1.18.2
• osTicket installations with exposed /pwreset.php endpoint

Discovery Timeline

• 2026-04-02 - CVE-2026-26895 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-26895

Vulnerability Analysis

This user enumeration vulnerability in osTicket's password reset functionality represents a classic information disclosure issue categorized under CWE-203 (Observable Discrepancy). The vulnerability allows unauthenticated attackers to determine whether a specific username or email address is registered in the osTicket system by observing differences in the application's response when submitting password reset requests.

When a password reset request is submitted to /pwreset.php, the application likely returns different responses based on whether the submitted username or email exists in the database. These differences can manifest as variations in HTTP response codes, response content, response timing, or error messages. Attackers can automate requests to this endpoint to systematically enumerate all valid accounts.

Additional technical analysis is available from the CSA Cyber Blog Analysis.

Root Cause

The root cause of this vulnerability lies in the application's failure to provide consistent responses regardless of whether a submitted username exists in the system. Secure password reset implementations should return identical responses for both valid and invalid usernames, preventing attackers from distinguishing between the two cases. The /pwreset.php endpoint in osTicket v1.18.2 does not implement this security best practice, creating an observable discrepancy that leaks account existence information.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending HTTP requests to the /pwreset.php endpoint with different username or email values and analyzing the responses. The attack can be easily automated using scripts or tools like Burp Suite Intruder, enabling rapid enumeration of large username lists against vulnerable osTicket installations.

The attacker workflow typically involves:

1. Identifying an osTicket installation with an accessible password reset page
2. Submitting password reset requests with candidate usernames
3. Analyzing response differences to identify valid accounts
4. Using the enumerated accounts for targeted attacks

Detection Methods for CVE-2026-26895

Indicators of Compromise

• High volume of requests to /pwreset.php from single IP addresses or IP ranges
• Sequential or pattern-based username submissions to the password reset endpoint
• Automated tool signatures in User-Agent headers targeting the password reset functionality
• Failed password reset attempts followed by authentication attempts for enumerated accounts

Detection Strategies

• Implement rate limiting monitoring on the /pwreset.php endpoint to detect enumeration attempts
• Configure web application firewall (WAF) rules to alert on repeated password reset requests
• Monitor authentication logs for login attempts against accounts that recently received password reset requests
• Deploy anomaly detection for unusual traffic patterns to password reset functionality

Monitoring Recommendations

• Enable detailed logging for all requests to /pwreset.php including source IP, timestamps, and submitted usernames
• Set up alerting thresholds for password reset request volumes exceeding normal baselines
• Correlate password reset activity with subsequent authentication attempts to identify reconnaissance-to-attack patterns
• Review access logs regularly for signs of automated enumeration tools

How to Mitigate CVE-2026-26895

Immediate Actions Required

• Implement rate limiting on the /pwreset.php endpoint to slow down enumeration attempts
• Configure the password reset function to return identical responses for both valid and invalid usernames
• Consider implementing CAPTCHA on the password reset form to prevent automated enumeration
• Review and restrict access to the password reset functionality from untrusted networks if possible

Patch Information

At the time of publication, no official patch information has been released. Organizations should monitor the osTicket Official Site for security updates. Until a patch is available, implement the recommended workarounds to reduce exposure to this vulnerability.

Workarounds

• Implement generic response messages for all password reset requests (e.g., "If an account exists with this email, a reset link will be sent")
• Add artificial delays to normalize response times between valid and invalid username submissions
• Deploy a web application firewall (WAF) with rules to detect and block enumeration attempts
• Consider placing the osTicket installation behind VPN or IP allowlisting if public access is not required

# Example rate limiting configuration for nginx
# Add to server block or location directive for /pwreset.php
limit_req_zone $binary_remote_addr zone=pwreset:10m rate=5r/m;

location /pwreset.php {
    limit_req zone=pwreset burst=2 nodelay;
    # existing configuration
}