CVE-2026-38447Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-331

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-08-03); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

HOL@HashgraphOnline87d
Disclosure
CVE-2026-38447 (CVSS 9.8): osTicket (5M+ users, 15K+ businesses) generates API keys using MD5(timestamp, IP, seed). An attacker who approximates the generation time can brute-force the key space. One valid key unlocks the entire ticketing system. Fixed via CSPRNG replacement. https://hol.org/blog/cve-2026-38447-osticket-predictable-api-keys
Post summary
The blog post announces CVE-2026-38447, detailing its severe vulnerability involving predictable API key generation in osTicket, the attack vector, and notes that the issue has been fixed by replacing the key generation algorithm with a CSPRNG.
040501.1K
19.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-38447 Predictable API Key Generation in osTicket 1.18.3 via MD5 Hashing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-38447
Post summary
A CVE details a flaw in osTicket 1.18.3 that results in predictable API keys generated with MD5 hashing. The post does not provide a PoC, exploit code, active exploitation evidence, or patch information.
0000095
4.1K followersView on X

Explore more

Back to dashboard