CVE-2026-38447: osTicket API Key Prediction Vulnerability

CVE-2026-38447 Overview

CVE-2026-38447 affects osTicket version 1.18.3, an open-source customer support ticketing system. The vulnerability stems from predictable API key generation using MD5 hashing combined with low-entropy inputs. The key generation routine concatenates the current Unix timestamp, the requesting client IP address, and an MD5 of a 16-character random code. Attackers who can approximate the key creation time and know the source IP can brute-force the API key within a feasible time window. Successful exploitation grants unauthenticated network access to the osTicket API, enabling ticket manipulation and data disclosure. The issue is classified under [CWE-331: Insufficient Entropy].

Critical Impact
Predictable MD5-based API key construction allows remote attackers to brute-force valid API credentials and gain unauthorized access to osTicket instances.

Affected Products

osTicket 1.18.3
osTicket versions using the vulnerable class.api.php key generation routine
Self-hosted osTicket deployments exposing the API endpoint

Discovery Timeline

2026-08-03 - CVE-2026-38447 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-38447

Vulnerability Analysis

The vulnerability resides in include/class.api.php at line 149 of osTicket 1.18.3. The API key is generated by concatenating time(), the client IP address, and an MD5 of a 16-character Misc::randCode() output. The entire concatenated value is then hashed with MD5 and uppercased to form the API key. MD5 produces a 128-bit output but the effective entropy is bounded by the predictability of its inputs. An attacker who knows or guesses the approximate key creation timestamp and the source IP address only needs to brute-force the inner Misc::randCode(16) output, which is drawn from a limited character set.

Root Cause

The root cause is insufficient entropy [CWE-331] in cryptographic material generation. Two of the three inputs (time() and ipaddr) are attacker-observable or narrowly guessable. MD5 is not a suitable primitive for generating secrets and offers no protection when the input space is small. The API key becomes a function of predictable data rather than a cryptographically secure random value.

Attack Vector

Exploitation occurs over the network with no authentication or user interaction required. An attacker enumerates candidate timestamps around the suspected key issuance window, combines them with the known or guessed IP, and iterates over the reduced randCode search space to reconstruct valid API keys. Each candidate is validated by issuing an API request. Once a valid key is discovered, the attacker gains full API-level access to the target osTicket instance.

php

// Vulnerable key construction (osTicket 1.18.3, class.api.php)
$sql='INSERT INTO '.API_KEY_TABLE.' SET '.$sql
    .',created=NOW() '
    .',ipaddr='.db_input($vars['ipaddr'])
    .',apikey='.db_input(strtoupper(md5(time().$vars['ipaddr'].md5(Misc::randCode(16)))));

// Patched key construction
$sql='INSERT INTO '.API_KEY_TABLE.' SET '.$sql
    .',created=NOW() '
    .',ipaddr='.db_input($vars['ipaddr'])
    .',apikey='.db_input(strtoupper(Misc::randCode(48, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789')));

Source: GitHub Commit feccb6a

Detection Methods for CVE-2026-38447

Indicators of Compromise

High volumes of HTTP requests to /api/* endpoints from a single source IP with varying X-API-Key header values
Successful API authentications originating from IP addresses not previously associated with legitimate integrations
Web server access logs showing rapid iteration through candidate API key values
Ticket creation or modification activity through the API outside normal integration windows

Detection Strategies

Rate-limit and alert on repeated 401 or 403 responses from /api/http.php and related endpoints against the same client IP
Correlate apikey table created timestamps with subsequent API usage patterns to identify keys used immediately after issuance from unexpected origins
Deploy web application firewall rules that flag brute-force patterns targeting the API key header

Monitoring Recommendations

Audit the ostickt_api_key database table for keys generated on osTicket 1.18.3 or earlier and rotate all entries after upgrading
Enable verbose web server logging on API endpoints to retain header and IP data for forensic review
Monitor for anomalous API traffic volume, geographic origin, and off-hours activity against baseline integration behavior

How to Mitigate CVE-2026-38447

Immediate Actions Required

Upgrade osTicket to a version containing commit feccb6a3a90863fd31215ee738b39762177e658c or later
Revoke and regenerate all existing API keys issued by vulnerable installations, since prior keys retain their predictable construction
Restrict API endpoint access by source IP allowlisting at the reverse proxy or firewall until patching is complete
Review recent API activity for unauthorized ticket access or modification

Patch Information

The upstream fix replaces the MD5-based construction with Misc::randCode(48, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'), producing a 48-character alphanumeric key from a broader random source. The patch also applies Format::shroud() in the admin UI to reduce API key exposure in the interface. See the official commit for full changes.

Workarounds

Place osTicket behind a reverse proxy that enforces mutual TLS or a secondary authentication token on /api/* paths
Disable the API module in osTicket administration if API access is not required
Apply strict IP allowlisting so only known integration hosts can reach the API endpoint

bash

# Example nginx allowlist for osTicket API endpoint
location /api/ {
    allow 10.0.0.0/24;      # Trusted integration subnet
    allow 192.0.2.10;       # Specific integration host
    deny all;
    proxy_pass http://osticket_backend;
}