osTicket CVE-2026-9507

Exploitation requires two sequential preconditions. First, the attacker must obtain a valid pre-authentication OSTSESSID from the osTicket server - trivially achieved by any anonymous visitor loading the login page. Second, and critically, the attacker must inject this known session token into the victim's browser before the victim authenticates; this requires an auxiliary delivery mechanism such as a URL carrying a session parameter (if osTicket accepts session IDs via query string), a subdomain or path-scoped cookie injection technique, or a separate cross-site scripting vector on the same domain. The victim must then actively log in during the attacker-controlled session window, satisfying the UI:A requirement in the CVSS 4.0 vector. Exploitation is bounded to the victim's own account - no privilege escalation to administrator is implied. The vulnerability is present in default osTicket v1.18.2 deployments and does not require any non-standard server configuration, but the cookie-injection prerequisite meaningfully constrains opportunistic mass exploitation.

The CVSS 4.0 base score of 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:A accurately captures network reachability and no attacker privileges, but the AC:L designation understates the practical difficulty: the attacker must successfully deliver a pre-known session identifier into the victim's browser before login, which requires an auxiliary vector such as URL session injection, subdomain cookie injection, or a separate XSS flaw. Confidentiality and integrity impacts are both Low (VC:L/VI:L), limited to the victim's individual account rather than systemic server compromise; availability is unaffected. No EPSS score is provided and this CVE is not listed in the CISA KEV catalog, indicating no confirmed or widespread active exploitation. The vulnerability is a real and well-understood attack class but is not a critical priority absent evidence of targeted exploitation - organizations handling sensitive help desk data (PII, internal communications) should treat patching as timely rather than emergency. The CWE-38 attribution in the source data is flagged as a likely typographic error and reduces confidence in the completeness of the original report.

An attacker anonymously visits the osTicket portal to obtain a valid pre-authentication OSTSESSID, then delivers this token to the victim's browser via a crafted phishing URL or a cookie-injection technique targeting the application's domain. The victim follows the link and logs in normally; because osTicket does not rotate the session ID at login, the attacker's pre-seeded OSTSESSID now maps to a fully authenticated session. The attacker then uses that known session ID to submit authenticated requests as the victim, accessing support tickets and any account-accessible data. No public POC code has been identified at time of analysis.