What is the CVSS score of CVE-2026-38447?

CVE-2026-38447 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of osTicket are affected by CVE-2026-38447?

osTicket 1.18.3 deployments face immediate critical risk: remote attackers can forge staff API keys without credentials, gaining unauthorized access to sensitive customer support tickets and system…

How to fix or mitigate CVE-2026-38447?

Within 24 hours: Inventory all osTicket 1.18.3 instances and immediately restrict API endpoint access to known, trusted IP ranges via firewall rules; disable API key authentication in osTicket if operationally feasible. Within 7 days: Implement strict rate limiting on all authentication endpoints, enable detailed API request logging with alerts for brute-force patterns, and contact osTicket support or check for patch availability in version 1.18.4+. Within 30 days: Execute migration to patched osTicket version (1.18.4+, 1.19+, or later stable release) or deploy permanent compensating controls if upgrade timeline extends beyond 30 days.

osTicket CVE-2026-38447

EUVD-2026-52402 CRITICAL

Insufficient Entropy (CWE-331)

2026-08-03 mitre

GHSA-phjh-749w-3xjq

Information Disclosure N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.4 HIGH

Network, no auth (PR:N), but brute-force needs attacker-bounded timestamp/IP plus defeating a nested random component, so AC:H; API key access impacts ticket data confidentiality/integrity, not availability.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 03, 2026 - 21:26 vuln.today

Analysis Generated

Aug 03, 2026 - 21:26 vuln.today

CVE Published

Aug 03, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.

AnalysisAI

Predictable API key generation in osTicket 1.18.3 lets remote attackers reconstruct valid staff API keys by exploiting weak MD5-based construction seeded with the request timestamp and client IP address (CWE-331). Because the key is derived from low-entropy, guessable inputs, an attacker who approximates the key creation window can brute-force the key space and gain API access without credentials. Rated CVSS 9.8 by the reporter; no public exploit is identified at time of analysis, though a technical disclosure write-up exists, and CISA SSVC lists exploitation as none but marks the flaw automatable with total technical impact.

Technical ContextAI

osTicket is an open-source PHP helpdesk/ticketing platform; the affected logic is in include/class.api.php, where the API key was computed as strtoupper(md5(time().$vars['ipaddr'].md5(Misc::randCode(16)))). CWE-331 (Insufficient Entropy) is the root cause: MD5 is fast and unsuitable for secret generation, and two of the three inputs (Unix timestamp and the client IP address) are knowable or narrowly guessable by an attacker who observes or triggers key creation. The fix commit (feccb6a3) replaces this with Misc::randCode(48, 'A-Z0-9'), a 48-character random string, and additionally shrouds displayed keys in include/staff/apikeys.inc.php. CPE data is uninformative (cpe:2.3:a:n/a:n/a:*), so affected-product scoping relies on the source references pinning the flaw to the v1.18.3 tree.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in commit feccb6a3a90863fd31215ee738b39762177e658c, which replaces MD5-derived keys with Misc::randCode(48,'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789') and shrouds key display, then upgrade to the first tagged osTicket release that includes it once published. As an immediate compensating control, manually rotate/regenerate all existing API keys after patching (keys created by the old routine remain weak even after upgrade) and, if you cannot patch now, disable or delete unused API keys and restrict access to the API endpoint (api/*) by source IP/firewall so only known integration hosts can reach it - trade-off being that legitimate remote integrations from other addresses will break. Also consider serving osTicket only over trusted networks/VPN until keys are rotated. Confirm details against the VulDB advisory (https://vuldb.com/vuln/385644).