CVE-2026-18363
CriticalCVSS 9.1Summary
In osTicket versions prior to 1.17.8 and 1.18.4, a logic flaw in password reset token validation causes the expiry check to be performed only when the timestamp lookup fails, allowing reuse of a valid token.
Risk Assessment
An attacker who obtains a valid password reset token can reuse it to perform unauthorized password resets and compromise user accounts.
Recommendation
Upgrade osTicket to version 1.17.8 or 1.18.4, which includes a fix for the password reset token validation logic.
Original NVD description (English source)
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired. Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the intended expiry validation. Therefore, an attacker able to obtain a valid password reset token could reuse it to perform an unauthorised password reset and compromise the affected account.