A user enumeration flaw exists in the password reset page of osTicket 1.18.2 that allows a remote attacker to determine whether a specific username is registered on the system. The flaw arises because the application provides different responses for valid versus invalid usernames, enabling an attacker to infer account existence. This type of weakness falls under the Common Weakness Enumeration category CWE‑203, which covers insufficient output information leading to information disclosure.

The vulnerability affects installations of osTicket running version 1.18.2. The affected product is osTicket, published by Enhancesoft, as indicated by the CPE string for enhancesoft:osticket. Any deployment that has not applied subsequent fixes in later releases is susceptible.

The flaw carries a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low probability of exploitation at this time. It is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker can exploit the vulnerability remotely by sending crafted HTTP requests to the /pwreset.php endpoint; no authentication is required, and the attack can be performed from any network that can reach the web server.