CVE-2026-18363

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired. Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the intended expiry validation. Therefore, an attacker able to obtain a valid password reset token could reuse it to perform an unauthorised password reset and compromise the affected account.

CVSS

No CVSS.

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/weak-password-recovery-mechanism-osticket-enhancesoft-llc

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad lógica en la rutina de validación de tokens de restablecimiento de contraseña implementada por osTicket en versiones anteriores a la v1.17.8 y v1.18.4. Durante el proceso de restablecimiento de contraseña, la aplicación recupera la marca de tiempo asociada con el token proporcionado y verifica si el período de validez configurado ha expirado. En consecuencia, la verificación de caducidad solo se realiza si la búsqueda de la marca de tiempo falla, permitiendo que los tokens con una marca de tiempo existente eludan la validación de caducidad prevista. Por lo tanto, un atacante capaz de obtener un token de restablecimiento de contraseña válido podría reutilizarlo para realizar un restablecimiento de contraseña no autorizado y comprometer la cuenta afectada.

Information

Published : 2026-07-30 11:16

Updated : 2026-10-23 22:10

NVD link : CVE-2026-18363

Mitre link : CVE-2026-18363

CVE.ORG link : CVE-2026-18363

JSON object : View

Products Affected

No product.

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2026-18363", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18363", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-30T12:20:18.450834Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@incibe.es", "affectedData": [{"vendor": "Enhancesoft LLC", "product": "osTicket", "versions": [{"status": "affected", "version": "0", "lessThan": "1.17.8", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "1.18.4", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T11:16:26.220", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/weak-password-recovery-mechanism-osticket-enhancesoft-llc", "source": "cve-coordination@incibe.es"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired. Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the intended expiry validation. Therefore, an attacker able to obtain a valid password reset token could reuse it to perform an unauthorised password reset and compromise the affected account."}, {"lang": "es", "value": "Una vulnerabilidad l\u00f3gica en la rutina de validaci\u00f3n de tokens de restablecimiento de contrase\u00f1a implementada por osTicket en versiones anteriores a la v1.17.8 y v1.18.4. Durante el proceso de restablecimiento de contrase\u00f1a, la aplicaci\u00f3n recupera la marca de tiempo asociada con el token proporcionado y verifica si el per\u00edodo de validez configurado ha expirado. En consecuencia, la verificaci\u00f3n de caducidad solo se realiza si la b\u00fasqueda de la marca de tiempo falla, permitiendo que los tokens con una marca de tiempo existente eludan la validaci\u00f3n de caducidad prevista. Por lo tanto, un atacante capaz de obtener un token de restablecimiento de contrase\u00f1a v\u00e1lido podr\u00eda reutilizarlo para realizar un restablecimiento de contrase\u00f1a no autorizado y comprometer la cuenta afectada."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "cve-coordination@incibe.es"}