Vulnerability Description
A session fixation vulnerability has been identified in osTicket v1.18.2. This security flaw allows an attacker to hijack a victim’s account by keeping the initial session identifier (OSTSESSID) active after a successful login. The issue lies in the fact that the application does not invalidate the pre-authentication cookie or generate a new identifier for the authenticated context. As a result, if an attacker manages to set a known session identifier in the victim’s browser, they will be able to maintain unauthorised access to the account once the victim has authenticated.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-9507?
CVE-2026-9507 is a documented vulnerability. A session fixation vulnerability has been identified in osTicket v1.18.2. This security flaw allows an attacker to hijack a victim’s account by keeping the initial session identifier (OSTSESSID) activ...
How severe is CVE-2026-9507?
CVSS scoring is not yet available for CVE-2026-9507. Check NVD for updates.
Is there a patch for CVE-2026-9507?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.