CVE-2026-9507: Session fixation vulnerability in Enhancesoft's osTicket
A session fixation vulnerability has been identified in osTicket v1.18.2. This security flaw allows an attacker to hijack a victim’s account by keeping the initial session identifier (OSTSESSID) active after a successful login.
The issue lies in the fact that the application does not invalidate the pre-authentication cookie or generate a new identifier for the authenticated context. As a result, if an attacker manages to set a known session identifier in the victim’s browser, they will be able to maintain unauthorised access to the account once the victim has authenticated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate session fixation by ensuring osTicket invalidates the pre-authentication cookie and does not keep the known session identifier (OSTSESSID) active after successful login.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9507?
The severity of CVE-2026-9507 is rated as medium with a score of 5.1.
How do I fix CVE-2026-9507?
Fixing CVE-2026-9507 involves updating to the latest version of osTicket where the session fixation vulnerability has been addressed.
What type of vulnerability is CVE-2026-9507?
CVE-2026-9507 is identified as a session fixation vulnerability that allows account hijacking.
Which software is affected by CVE-2026-9507?
CVE-2026-9507 affects Enhancesoft's osTicket version 1.18.2.
When was CVE-2026-9507 published?
CVE-2026-9507 was published on June 16, 2026.