osTicket versions prior to 1.17.8 and 1.18.4 contain a logic flaw in the password reset token validation routine. The application retrieves the timestamp associated with a password reset token and is supposed to check if the token has expired based on a configured validity period. However, the expiry check is only performed if the timestamp lookup fails, meaning tokens with an existing timestamp bypass the expiry validation. This allows an attacker who obtains a valid password reset token to reuse it multiple times to reset the password of the associated account without authorization.

An attacker who obtains a valid password reset token can reuse it beyond the intended expiration period to reset the password of the targeted account. This compromises account security and can lead to unauthorized access. The vulnerability affects the confidentiality and integrity of user accounts in osTicket.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 1.17.8 and 1.18.4, upgrading to these or later versions is likely recommended once official fixes are released. Until then, restrict access to password reset tokens and monitor for suspicious activity related to password resets.