CVE-2026-101268: Customer session fixation
If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.
Event History
Frequently Asked Questions
When is an installation exposed to this issue?
The attack only works when the event is available on a different domain than the organizer page. Deployments where the event and organizer page are not split across different domains are not described as affected by this condition.
What must an attacker do to exploit it?
The attacker must convince a victim to open a specially crafted link. Successful exploitation logs the victim into the attacker’s customer account.
What is the practical impact if a victim does not notice the account switch?
The victim’s order details may be stored in the attacker’s customer account. This could expose information associated with orders the victim places while logged into that account.