Executive brief
osTicket, a popular open-source customer support ticket system, contains a flaw in how it handles password reset requests. An attacker who manages to obtain a password reset link could reuse it indefinitely to change a user's password, even after the link should have expired. This could lead to unauthorized access to staff or customer accounts and the sensitive support data they contain.
Technical details
A logic error exists in the password reset token validation routine of osTicket. When a user attempts a password reset, the application retrieves the timestamp associated with the token but only executes the expiration check if the timestamp lookup fails. Because valid tokens have an existing timestamp, they successfully bypass the intended validity period check. An attacker who obtains a valid reset token (e.g., through traffic interception or local access) can reuse that token indefinitely to perform unauthorized password resets. The issue is resolved in versions v1.17.8 and v1.18.4.
Affected products
- Enhancesoft LLC osTicket prior to v1.17.8 and v1.18.4
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory
- 2026-07-30: patched: Fixed in versions v1.17.8 and v1.18.4