EUVD-2026-52402
GHSA-phjh-749w-3xjq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network, no auth (PR:N), but brute-force needs attacker-bounded timestamp/IP plus defeating a nested random component, so AC:H; API key access impacts ticket data confidentiality/integrity, not availability.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.
AnalysisAI
Predictable API key generation in osTicket 1.18.3 lets remote attackers reconstruct valid staff API keys by exploiting weak MD5-based construction seeded with the request timestamp and client IP address (CWE-331). Because the key is derived from low-entropy, guessable inputs, an attacker who approximates the key creation window can brute-force the key space and gain API access without credentials. Rated CVSS 9.8 by the reporter; no public exploit is identified at time of analysis, though a technical disclosure write-up exists, and CISA SSVC lists exploitation as none but marks the flaw automatable with total technical impact.
Technical ContextAI
osTicket is an open-source PHP helpdesk/ticketing platform; the affected logic is in include/class.api.php, where the API key was computed as strtoupper(md5(time().$vars['ipaddr'].md5(Misc::randCode(16)))). CWE-331 (Insufficient Entropy) is the root cause: MD5 is fast and unsuitable for secret generation, and two of the three inputs (Unix timestamp and the client IP address) are knowable or narrowly guessable by an attacker who observes or triggers key creation. The fix commit (feccb6a3) replaces this with Misc::randCode(48, 'A-Z0-9'), a 48-character random string, and additionally shrouds displayed keys in include/staff/apikeys.inc.php. CPE data is uninformative (cpe:2.3:a:n/a:n/a:*), so affected-product scoping relies on the source references pinning the flaw to the v1.18.3 tree.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in commit feccb6a3a90863fd31215ee738b39762177e658c, which replaces MD5-derived keys with Misc::randCode(48,'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789') and shrouds key display, then upgrade to the first tagged osTicket release that includes it once published. As an immediate compensating control, manually rotate/regenerate all existing API keys after patching (keys created by the old routine remain weak even after upgrade) and, if you cannot patch now, disable or delete unused API keys and restrict access to the API endpoint (api/*) by source IP/firewall so only known integration hosts can reach it - trade-off being that legitimate remote integrations from other addresses will break. Also consider serving osTicket only over trusted networks/VPN until keys are rotated. Confirm details against the VulDB advisory (https://vuldb.com/vuln/385644).
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-331 – Insufficient Entropy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today