Executive brief
osTicket, a popular open-source customer support and IT ticketing platform, is affected by a security flaw in its password reset process. An attacker can determine which email addresses or usernames are registered on the system by measuring how long the server takes to respond to reset requests. This information can be used to build a list of valid targets for more serious attacks, such as phishing, account takeovers, or credential stuffing.
Technical details
A timing side-channel vulnerability exists in the `/pwreset.php` endpoint of osTicket versions prior to 1.18.3. When SMTP is configured, the application exhibits a measurable discrepancy in response times: valid usernames trigger an SMTP email dispatch (taking several seconds), while invalid usernames return an error immediately (under one second). An unauthenticated remote attacker can use automated tools like Burp Suite Intruder to perform a timing attack and enumerate valid accounts. The vulnerability was addressed in version 1.18.3 by implementing a minimum response threshold of 1.4 seconds with added random jitter to normalize response times.
Affected products
- EnhanceSoft osTicket Up to (excluding) 1.18.3
Timeline
- 2026-01-15: disclosed: Vulnerability reported to vendor
- 2026-01-15: patched: Vendor released version 1.18.3 and commit d832f24
- 2026-04-02: advisory: NVD publication date