CVE-2026-38447

CRITICAL

osTicket 1.18.3 - Predictable API Key Generation via Insufficient Entropy in MD5 Hashing

Title source: llm

Description

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.

References (4)

Core 4

Core References

https://github.com/osTicket/osTicket/blob/v1.18.3/include/class.api.php#L149

View Writeup ZIP pw:eip

https://github.com/osTicket/osTicket/blob/v1.18.3/include/class.misc.php

View Writeup ZIP pw:eip

https://github.com/osTicket/osTicket/commit/feccb6a3a90863fd31215ee738b39762177e658c

View Patch ZIP pw:eip

https://github.com/fr3akhacks/cve-disclosures/blob/master/osTicket/CVE-2026-38447.md

View Writeup ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0046

EPSS Percentile 37.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-331

Status published

Published Aug 03, 2026

Tracked Since Aug 04, 2026