VulnSocial

CVE-2026-18363Disclosure

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired. Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the intended expiry validation. Therefore, an attacker able to obtain a valid password reset token could reuse it to perform an unauthorised password reset and compromise the affected account.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-640

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-31: 107-31
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • INCIBE-CERT@incibe_cert
    Disclosure

    ⚠️#INCIBEavisos | Mecanismo débil de recuperación de contraseña en osTicket de Enhancesoft LLC #CVE CVE-2026-18363 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/mecanismo-debil-de-recuperacion-de-contrasena-en-osticket-de-enhancesoft-llc #AvisosDeSeguridad #TI #CNA #0day

    Post summary

    An advisory that warns of a weak password recovery mechanism in osTicket (CVE‑2026‑18363) and directs readers to an official INCIBE alert page for details.

    0000093
    25 followersView on X

Explore more

Back to dashboard