EUVD-2026-37079
GHSA-6cj6-2fg2-2r4g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required auxiliary step of injecting a known session token into the victim's browser; UI:R for victim login; C/I:L scoped to single account; no availability impact.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A session fixation vulnerability has been identified in osTicket v1.18.2. This security flaw allows an attacker to hijack a victim’s account by keeping the initial session identifier (OSTSESSID) active after a successful login.
The issue lies in the fact that the application does not invalidate the pre-authentication cookie or generate a new identifier for the authenticated context. As a result, if an attacker manages to set a known session identifier in the victim’s browser, they will be able to maintain unauthorised access to the account once the victim has authenticated.
AnalysisAI
Session fixation in osTicket v1.18.2 enables remote attackers to hijack authenticated user accounts by pre-seeding a known OSTSESSID cookie before the victim logs in. The application fails to invalidate or regenerate the session identifier upon successful authentication, so an attacker who plants a known token in the victim's browser retains access to that session once the victim authenticates. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 5.1 (Medium) reflects limited per-account impact and a mandatory victim-interaction prerequisite.
Technical ContextAI
osTicket is an open-source web-based help desk and ticketing system developed by Enhancesoft (CPE: cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*). The root cause is the application's failure to rotate the OSTSESSID session cookie at the privilege-elevation boundary - specifically, upon successful login. The vulnerability is reported under CWE-38, which is not a recognized CWE identifier; the correct classification for this class of flaw is CWE-384 (Session Fixation), and the description confirms this is the actual vulnerability. In PHP-based ticketing systems like osTicket, session IDs established during anonymous browsing are intended to be discarded and replaced with a new identifier once authentication succeeds. When this rotation is absent, an attacker who has previously obtained and injected a valid pre-authentication session token can inherit the authenticated session state.
RemediationAI
A vendor-released patch is confirmed as available per the INCIBE advisory; administrators should upgrade to the fixed osTicket release described at https://www.incibe.es/en/incibe-cert/notices/aviso/session-fixation-vulnerability-enhancesofts-osticket. An exact patched version number is not confirmed in the available source data - verify the specific target version against the INCIBE notice and Enhancesoft's official release channel before deploying. If immediate patching is not feasible, reduce session lifetime to the shortest operationally acceptable window to limit the exploitation interval, noting that this degrades user experience without eliminating the flaw. Additionally, consider deploying a web application firewall rule that flags or blocks authenticated requests arriving with session tokens that were issued more than a defined interval before the login event occurred. Neither workaround addresses the root cause and both have operational trade-offs.
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. Rate
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. Rated critical severity (CVSS 9
Arbitrary local file read in Enhancesoft osTicket 1.18.x (before 1.18.3) and 1.17.x (before 1.17.7) lets a remote unauth
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Rated high severity (CVSS 8.8), this vulnera
In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Rated medium severity (CVSS 6.1), this vulne
Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail addre
A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 cha
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticate
In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.ph
Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers
Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attac
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today