What is CVE-2026-18363?
A logic flaw exists in osTicket's password reset token validation routine, where the check for the token's configured validity period after retrieving its timestamp may be improperly implemented. This could allow the use of expired tokens. Versions prior to v1.17.8 and v1.18.4 are affected; updating immediately is strongly advised.
Azərbaycanca: osTicket platformasında password reset token-in müddətini yoxlayan validasiya mexanizmində məntiq zəifliyi aşkarlanıb. Bu boşluq köhnəlmiş token-lərin istifadəsinə imkan verə bilər. v1.17.8 və v1.18.4-dən əvvəlki versiyalar təsirlənir, dərhal güncəllənmə tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-287
FAQ2
Which functionality of osTicket is affected by CVE-2026-18363?
This vulnerability affects the validation routine that checks the validity period of the password reset token in osTicket.
To which versions should osTicket be updated to mitigate CVE-2026-18363?
To mitigate this vulnerability, osTicket should be updated to version v1.17.8 or v1.18.4.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.