Vulnerability Description
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/fr3akhacks/cve-disclosures/blob/master/osTicket/CVE-2026-3844
- https://github.com/osTicket/osTicket/blob/v1.18.3/include/class.api.php#L149
- https://github.com/osTicket/osTicket/blob/v1.18.3/include/class.misc.php
- https://github.com/osTicket/osTicket/commit/feccb6a3a90863fd31215ee738b39762177e
FAQ
What is CVE-2026-38447?
CVE-2026-38447 is a vulnerability with a CVSS score of 9.8 (CRITICAL). osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, signific...
How severe is CVE-2026-38447?
CVE-2026-38447 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-38447?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.