CVE-2026-38447
CriticalCVSS 9.8Summary
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing with low-entropy inputs like timestamp and client IP. This allows an attacker to brute-force the key within a feasible time window.
Risk Assessment
An attacker can gain unauthorized access to the osTicket API, potentially leading to disclosure of ticket data and system configuration.
Recommendation
Upgrade osTicket to the latest version that uses secure API key generation.
Original NVD description (English source)
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.