CVE-2026-38447CWE-331

CVE-2026-38447

Critical · published August 3, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00671 · 51.4th percentile
Weakness
CWE-331 · Insufficient Entropy
Published
2026-08-03T23:16Z
References (4)
https://github.com/fr3akhacks/cve-disclosures/blob/master/osTicket/CVE-2026-38447.md · [email protected]https://github.com/osTicket/osTicket/blob/v1.18.3/include/class.api.php#L149 · [email protected]https://github.com/osTicket/osTicket/blob/v1.18.3/include/class.misc.php · [email protected]https://github.com/osTicket/osTicket/commit/feccb6a3a90863fd31215ee738b39762177e658c · [email protected]
EPSS history
Timeline
  • 03 AUG 00:00Z
    osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing
    cvelistv5