PatchTheCVECVE-2026-18363: A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior
47
This month
CRITICAL 9.1REMOTE
CVE-2026-18363 is a critical-severity flaw (CVSS 9.1) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired. Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the inten
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 60%) |
| CISA exploited list | No |
| Weakness | CWE-640 |
| Published | 2026-07-30 |
| Last modified | 2026-10-23 |
Publisher (CNA): Spanish National Cybersecurity Institute, S.A. (INCIBE)
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Fedora 46 · python-trimesh · FIXED · 5.2.0-1.fc46 · FEDORA-2026-429b4bad4c · source
sudo dnf upgrade --advisory=FEDORA-2026-429b4bad4c
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.