Weak password recovery mechanism in osTicket by Enhancesoft LLC (CVE-2026-18363)

A logic vulnerability in osTicket's password reset token validation routine allows tokens with an existing timestamp to bypass expiry validation, as the expiry check is only performed when the timestamp lookup fails. An attacker who obtains a valid password reset token can reuse it indefinitely to perform an unauthorised password reset and take over the affected account. Affected versions: - versions prior to v1.17.8 - versions prior to v1.18.4 We recommend updating to: v1.17.8, v1.18.4. CVSS 9.1 · our assessment: act_now Reference: https://www.incibe.es/en/incibe-cert/notices/aviso/weak-password-recovery-mechanism-osticket-enhancesoft-llc Details: https://vuln.today/cve/CVE-2026-18363