Session Fixation Vulnerability in osTicket by EnhanceSoft

CVE-2026-9507

What is CVE-2026-9507?

A session fixation vulnerability has been discovered in osTicket v1.18.2, allowing attackers to hijack user accounts. This flaw occurs due to the application's failure to invalidate the pre-authentication cookie and generate a new session identifier upon successful user login. Consequently, if an attacker is able to set a known session identifier in the victim’s browser, they can maintain unauthorized access to the victim's account after authentication. Immediate patching and implementation of proper session management practices are recommended to mitigate this risk.

References