osTicket version 1.18.3 contains a vulnerability in its API key generation mechanism that relies on MD5 hashing with predictable inputs including the current timestamp and client IP address. This significantly reduces the entropy of generated keys, making them susceptible to brute-force attacks. An attacker who can approximate the key generation time can feasibly brute-force the key space within a practical time window. The vulnerability stems from the use of the cryptographically weak MD5 algorithm combined with low-entropy inputs. Exploitation could allow unauthorized access to the osTicket API. A fix has been committed to the osTicket repository. The issue is tracked as CVE-2026-38447 and affects the class.api.php and class.misc.php components of the application.