2026-18363 Weak password recovery mechanism in osTicket by Enhancesoft LLC

DESCRIPTION

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired.

Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the intended expiry validation. Therefore, an attacker able to obtain a valid password reset token could reuse it to perform an unauthorised password reset and compromise the affected account.

The vulnerability was discovered during a manual review of the osTicket password recovery mechanism.

During the audit, it was observed that the validation of password recovery tokens used the following logical condition:

elseif (!($ts = $_config->lastModified($_POST['token'])) && ($ost->getConfig()->getPwResetWindow() < (time() - strtotime($ts))))

The purpose of this check was to invalidate a token when no associated timestamp existed or when the configured validity window had been exceeded.

However, due to the use of the logical operator &&, the condition only considered the token invalid when both checks were simultaneously met. As a result, a token could remain valid in situations where it should already have been considered invalid.

After receiving the report, the vendor confirmed the finding and released a patch modifying the condition to:

elseif (!($ts = $_config->lastModified($_POST['token'])) || ($ost->getConfig()->getPwResetWindow() < (time() - strtotime($ts))))

Replacing the && operator with || ensures that the token is rejected when a valid timestamp does not exist or when the configured validity window has been exceeded, thereby restoring the expected behavior of the password recovery mechanism.

Commit de Github

The vulnerability was fully verified through source code analysis and review of the patch published by the vendor, making it unnecessary to develop a dedicated proof-of-concept exploit.

The vendor confirmed the finding, implemented the fix, and released the patch in osTicket versions 1.17.8 and 1.18.4. Subsequently, the process continued with the coordination of INCIBE-CERT for the assignment of the CVE-2026-18363 identifier.

DISCLOSURE TIMELINE

May 2026: Inicio de la revisión del código fuente de osTicket como parte de una iniciativa personal orientada al análisis de seguridad de proyectos de código abierto.
June 2026 - Identification of a vulnerability in the password recovery mechanism during the source code review.
June 12, 2026 - Responsible disclosure of the finding to the vendor (Enhancesoft LLC).
June – July 2026 - Technical validation of the finding and exchange of information with the security team.
July 2026 - Confirmation of the vulnerability and release of the patch in osTicket versions v1.17.8 and v1.18.4.
July 2026 - Coordination with INCIBE-CERT, acting as a CVE Numbering Authority (CNA), for the assignment of CVE-2026-18363.
August 2026 - Publication of CVE-2026-18363.

ABOUT

Internet Security Auditors is a Spain and Colombia based company leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.