The vulnerability lies in how osTicket 1.18.3 constructs API keys. It uses MD5 hashing together with the current timestamp and the client’s IP address, which are highly predictable. This flaw represents a CWE-331 instance of predictable random number generation. Because the resulting key space has very low entropy, an attacker can guess the construction pattern, estimate the key generation time, and brute‑force the key within a short window. If successful, the attacker obtains a valid API key that grants programmatic access to the ticketing system, potentially exposing sensitive data and allowing further exploitation of the platform.

The issue is present in osTicket version 1.18.3. No other affected versions are listed in the data provided.

The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The CVSS score of 9.8 indicates high severity. The predicted low entropy of the key generation process indicates that the risk is high for any environment using the affected default API key mechanism. The likely attack vector is remote: an attacker who can approximate the key generation time can systematically test candidate keys against the API endpoint until one succeeds. The consequence of a successful brute‑force is full API access, enabling data disclosure, manipulation, or any other actions permitted by the API.