CVE-2026-38447 Weak cryptography in n/a
Attackers can brute-force predictable API keys generated via weak MD5 hashing to gain unauthorized access to osTicket accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-38447?
CVE-2026-38447 is a critical vulnerability in n/a, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.
Weakness: CWE-331
Which versions are affected by CVE-2026-38447?
How do I fix CVE-2026-38447?
No fix has been published for CVE-2026-38447 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-38447 being exploited?
There is no known exploitation of CVE-2026-38447 in the wild and no public exploit code.
Sources
Also known as GHSA-phjh-749w-3xjq.