Session Fixation in osTicket

Executive Summary

CVE-2026-9507 is a session fixation vulnerability found in Enhancesoft's osTicket version 1.18.2. This flaw allows an attacker to hijack a victim's account by keeping the initial session identifier (OSTSESSID) active even after the victim logs in.

The root cause is that the application does not invalidate the pre-authentication session cookie or generate a new session ID after the user authenticates. Therefore, if an attacker manages to set a known session ID in the victim's browser before login, they can maintain unauthorized access to the victim's account after login.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to hijack a user's account by maintaining unauthorized access through a fixed session ID. This means the attacker can impersonate the victim, potentially accessing sensitive information or performing actions on their behalf within the osTicket system.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability arises because osTicket v1.18.2 does not invalidate the pre-authentication session cookie (OSTSESSID) or generate a new session identifier after login, allowing session fixation attacks.

Immediate mitigation steps include ensuring that the application invalidates the old session identifier and issues a new one upon successful authentication to prevent attackers from maintaining unauthorized access.

Since the osTicket codebase is currently in maintenance mode with delayed security updates, consider applying any available patches or workarounds from the vendor or restricting access to the affected system until a fix is available.

Useful 0 Not Useful 0

Compliance Impact

The session fixation vulnerability in osTicket v1.18.2 allows attackers to hijack user accounts by maintaining the initial session identifier after login, leading to unauthorized access.

Such unauthorized access to user accounts can result in exposure or misuse of personal or sensitive data, which may violate data protection requirements under regulations like GDPR and HIPAA.

Failure to properly invalidate session identifiers and protect user sessions can be seen as inadequate security controls, potentially impacting compliance with these standards that mandate safeguarding user data and ensuring confidentiality and integrity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves session fixation by maintaining the initial session identifier (OSTSESSID) after login. To detect it on your system or network, you can monitor HTTP traffic for session cookies that do not change after authentication.

Specifically, you can capture and analyze HTTP requests and responses to check if the OSTSESSID cookie remains the same before and after login, which indicates the session is not being invalidated or regenerated.

Commands to help detect this behavior include using tools like curl or browser developer tools to inspect cookies, or network traffic analyzers like Wireshark or tcpdump to capture HTTP headers.

• Use curl to perform a login and check the session cookie before and after authentication: curl -c cookies.txt -d 'username=USER&password=PASS' https://your-osticket-instance/login.php
• Use curl to access a protected page with the saved cookie and observe if the OSTSESSID remains unchanged: curl -b cookies.txt https://your-osticket-instance/dashboard.php -v
• Use browser developer tools (Network tab) to observe the Set-Cookie headers during login and verify if the OSTSESSID changes.
• Use tcpdump or Wireshark to capture HTTP traffic and filter for Set-Cookie headers related to OSTSESSID to check if the session ID is regenerated after login.

Useful 0 Not Useful 0