CVE-2026-26895: osTicket Information Disclosure Flaw

CVE-2026-26895 Overview

A user enumeration vulnerability exists in the /pwreset.php endpoint of osTicket v1.18.2. This security flaw allows remote attackers to enumerate valid usernames registered in the platform by analyzing response differences from the password reset functionality. This type of vulnerability (CWE-203: Observable Discrepancy) enables attackers to build a list of valid user accounts, which can then be targeted in subsequent attacks such as credential stuffing, password spraying, or phishing campaigns.

Critical Impact
Remote attackers can identify valid user accounts in osTicket deployments without authentication, enabling targeted attacks against known users.

Affected Products

osTicket v1.18.2
osTicket installations with exposed /pwreset.php endpoint

Discovery Timeline

2026-04-02 - CVE-2026-26895 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-26895

Vulnerability Analysis

This user enumeration vulnerability in osTicket's password reset functionality represents a classic information disclosure issue categorized under CWE-203 (Observable Discrepancy). The vulnerability allows unauthenticated attackers to determine whether a specific username or email address is registered in the osTicket system by observing differences in the application's response when submitting password reset requests.

When a password reset request is submitted to /pwreset.php, the application likely returns different responses based on whether the submitted username or email exists in the database. These differences can manifest as variations in HTTP response codes, response content, response timing, or error messages. Attackers can automate requests to this endpoint to systematically enumerate all valid accounts.

Additional technical analysis is available from the CSA Cyber Blog Analysis.

Root Cause

The root cause of this vulnerability lies in the application's failure to provide consistent responses regardless of whether a submitted username exists in the system. Secure password reset implementations should return identical responses for both valid and invalid usernames, preventing attackers from distinguishing between the two cases. The /pwreset.php endpoint in osTicket v1.18.2 does not implement this security best practice, creating an observable discrepancy that leaks account existence information.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending HTTP requests to the /pwreset.php endpoint with different username or email values and analyzing the responses. The attack can be easily automated using scripts or tools like Burp Suite Intruder, enabling rapid enumeration of large username lists against vulnerable osTicket installations.

The attacker workflow typically involves:

Identifying an osTicket installation with an accessible password reset page
Submitting password reset requests with candidate usernames
Analyzing response differences to identify valid accounts
Using the enumerated accounts for targeted attacks

Detection Methods for CVE-2026-26895

Indicators of Compromise

High volume of requests to /pwreset.php from single IP addresses or IP ranges
Sequential or pattern-based username submissions to the password reset endpoint
Automated tool signatures in User-Agent headers targeting the password reset functionality
Failed password reset attempts followed by authentication attempts for enumerated accounts

Detection Strategies

Implement rate limiting monitoring on the /pwreset.php endpoint to detect enumeration attempts
Configure web application firewall (WAF) rules to alert on repeated password reset requests
Monitor authentication logs for login attempts against accounts that recently received password reset requests
Deploy anomaly detection for unusual traffic patterns to password reset functionality

Monitoring Recommendations

Enable detailed logging for all requests to /pwreset.php including source IP, timestamps, and submitted usernames
Set up alerting thresholds for password reset request volumes exceeding normal baselines
Correlate password reset activity with subsequent authentication attempts to identify reconnaissance-to-attack patterns
Review access logs regularly for signs of automated enumeration tools

How to Mitigate CVE-2026-26895

Immediate Actions Required

Implement rate limiting on the /pwreset.php endpoint to slow down enumeration attempts
Configure the password reset function to return identical responses for both valid and invalid usernames
Consider implementing CAPTCHA on the password reset form to prevent automated enumeration
Review and restrict access to the password reset functionality from untrusted networks if possible

Patch Information

At the time of publication, no official patch information has been released. Organizations should monitor the osTicket Official Site for security updates. Until a patch is available, implement the recommended workarounds to reduce exposure to this vulnerability.

Workarounds

Implement generic response messages for all password reset requests (e.g., "If an account exists with this email, a reset link will be sent")
Add artificial delays to normalize response times between valid and invalid username submissions
Deploy a web application firewall (WAF) with rules to detect and block enumeration attempts
Consider placing the osTicket installation behind VPN or IP allowlisting if public access is not required

bash

# Example rate limiting configuration for nginx
# Add to server block or location directive for /pwreset.php
limit_req_zone $binary_remote_addr zone=pwreset:10m rate=5r/m;

location /pwreset.php {
    limit_req zone=pwreset burst=2 nodelay;
    # existing configuration
}