Loading story…
A high-severity vulnerability tracked as CVE-2026-38447 affects osTicket 1.18.3, where API keys were generated with MD5 using partially predictable inputs including the current timestamp and client IP address. The design made key generation sufficiently guessable that an attacker who could estimate creation time and source IP could brute-force or recover API keys far more easily than with properly random tokens, potentially enabling unauthorized REST API access, ticket creation as arbitrary users, and cron-job triggering for IP-whitelisted hosts.
The issue was disclosed by researcher Anindya Sankar Roy and later assigned a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with metadata indicating automatable exploitation potential but no known active exploitation. A subsequent osTicket security commit replaced the deterministic MD5-and-time-based scheme with a 48-character random uppercase alphanumeric key and updated the staff interface to partially mask API keys, reflecting broader secure-design guidance against broken or risky cryptographic algorithms such as MD5 and against predictable token generation.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-38447 was newly received by cve@mitre.org and modified the same day for the osTicket API key weakness. The entry added CVSS v3.1 scoring, CWE-331 classification, SSVC metadata, and references to the public disclosure, affected source files, and the fixing commit.
An osTicket commit replaced the deterministic MD5-and-time-based API key generation logic with a 48-character random uppercase alphanumeric key. The same commit also changed the staff UI to shroud displayed API keys instead of showing them in full, and stated it addressed a report from Anindya Sankar Roy.
A GitHub disclosure described weak API key generation in osTicket 1.18.3 and earlier, where MD5 was used with partially predictable inputs such as the current Unix timestamp and client IP address. The disclosure said no fixed version had been released at that time and credited Anindya Sankar Roy as the discoverer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FOSSBilling disclosed two critical vulnerabilities that can be chained to give unauthenticated attackers administrative access and remote code execution on billing platforms used by hosting providers. **CVE-2026-27604** is an authorization bypass in versions `0.5.4` through `0.7.2` that lets remote attackers reach privileged `/api/system/*` endpoints because the `system` API role is incorrectly mapped to the cron admin identity. **CVE-2026-28496** is a Twig server-side template injection flaw affecting versions `0.1.0` through `0.7.2`, where templates are rendered without a sandbox, exposing the Twig environment, API context, and the dependency injection container. Researchers said the chain allows attackers to read and modify databases, enumerate administrators, create admin accounts, generate privileged API tokens, poison the Symfony cache used by the extension installer, and install a malicious module to execute code as the web server user. The exposure is significant because affected instances may hold customer PII, billing records, payment processor secrets, hosting control panel credentials, sessions, and API tokens. FOSSBilling patched both issues in version **`0.8.0`** and advised defenders to block external access to `/api/system/*`, restrict API access to trusted IPs, rotate admin and client API tokens, invalidate active sessions, reset high-privilege credentials, audit templates for malicious Twig expressions, and review logs for suspicious `/api/system/` activity.
Jun 29, 2026
Two Perl distributions, **Ado::Sessions** and **Solstice::Session**, were disclosed with vulnerabilities that generate session identifiers from weak, predictable inputs, creating a risk of session prediction and unauthorized access. In **CVE-2026-5083**, Ado::Sessions through version `0.935` uses a SHA-1 hash seeded with Perl `rand`, epoch time, and process ID; in **CVE-2026-5085**, Solstice::Session through version `1440` uses an MD5 digest built from epoch time, a stringified hash reference, Perl `rand()`, and process ID, with the same pattern also affecting `Solstice::Subsession` via `_generateID`. Both flaws were classified under **CWE-340** and **CWE-338**, reflecting predictable values and insufficient entropy in security-sensitive randomness. The disclosures warn that attackers may be able to infer or guess the underlying inputs—particularly time and PID values—and derive valid session tokens to hijack active sessions. The Ado issue is compounded by the project’s abandoned status: the distribution is no longer maintained, has been removed from the CPAN index, and remains available only on BackPAN.
Jun 29, 2026
Red Hat released security updates for **Red Hat build of Keycloak** to fix a critical account-takeover vulnerability, tracked as `CVE-2026-18963`, in the `keycloak-services` component. The flaw affects the reset-credentials flow and allows an unauthenticated remote attacker to bypass the email verification step during password recovery, reset a victim's password, and take full control of the account. Affected versions include **26.4.x before 26.4.15** and **26.6.x before 26.6.6**, with scanners such as Nessus flagging vulnerable deployments based on reported version information. Red Hat addressed the issue in advisories **RHSA-2026:56523** and **RHSA-2026:56524**, releasing updated packages, container images, and an updated Operator for OpenShift. The advisories also bundle fixes for additional Keycloak security issues, including hidden group metadata disclosure, predictable account-linking hashes that could enable takeover through a malicious OIDC client, rotated client secret leakage via the Admin REST API, and a TOCTOU privilege-escalation bug. Red Hat advised customers to back up installations before upgrading, while **Red Hat JBoss Enterprise Application Platform Expansion Pack** was also listed as affected but did not yet have a vendor patch in the referenced reporting.
Aug 25, 2026