CVE-2026-101268

Customer session fixation

Published Sep 29, 2026 CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Description

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.

Analysis

Technical impact

A crafted link can cause a victim to be logged into an attacker’s customer account, allowing the attacker to place orders and have the victim’s payment details stored in that account. The flaw is a session fixation weakness (CWE‑384) that can lead to disclosure of order information but does not provide broader system access.

Affected Systems

The vulnerability affects the pretix event ticketing platform. No specific version range is listed; any deployment of pretix that allows separate event and organizer domains may be impacted.

Risk and Exploitability

The CVSS score of 1.7 reflects a very low severity. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The attack requires a victim to click a malicious link and only succeeds when the event is hosted on a different domain than the organizer page, making it a limited and user‑interaction–dependent risk.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pretix

unaffected

Version	Status	Constraints
`0.0`	affected	< 2026.5.5
`2026.6.0`	affected	< 2026.6.2
`2026.7.0`	affected	< 2026.7.1

No data.

Vendor Product Versions

Pretix

Version	Status	Scheme	Platform
`[0.0,2026.5.5)`	affected	generic	—
`[2026.6.0,2026.6.2)`	affected	semver	—
`[2026.7.0,2026.7.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest pretix release if it contains a session‑fixation fix or consult the vendor for an update.
Modify the deployment so that event pages are served from the same domain as the organizer site or enforce same‑origin policies to prevent cross‑domain session hijacking.
Configure pretix to regenerate the session identifier after each successful login to mitigate session fixation attacks.

Generated by OpenCVE AI on September 30, 2026 at 03:01 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.197% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://pretix.eu/about/en/blog/20260929-release-2026-7-1/

History

Sep 29, 2026 5:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Pretix Pretix pretix
Vendors & Products		Pretix Pretix pretix

Sep 29, 2026 3:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-384
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 29, 2026 1:15 PM Description updated. Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.
Title		Customer session fixation
References		https://pretix.eu/about/en/blog/20260929-release-2026-7-1/
Metrics		cvssV4_0 `{'score': 1.7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U'}`