A logic flaw in osTicket’s password reset routine bypasses token expiration checks when the token’s timestamp exists, permitting an attacker who owns a legitimate reset token to reuse it at will. This can lead to full compromise of the affected user account through an unauthorised password reset, effectively granting the attacker control over the account and its data.

The affected product is Enhancesoft LLC’s osTicket system, specifically versions prior to v1.17.8 and v1.18.4. Any instance of osTicket running these revisions is vulnerable due to the token validation implementation.

The CVSS score of 9.1 classifies the issue as critical, while an EPSS score of less than 1% indicates a low but not negligible probability of exploitation. The vulnerability is currently not listed in the CISA KEV catalog. An attacker who obtains a valid password reset token could reuse that token to reset the password without triggering the intended expiry validation, thereby compromising the target account. Based on the description, it is inferred that an attacker might acquire the token through typical phishing or social engineering techniques, but the CVE description does not explicitly state the acquisition method.