KTM System e‑BOK accepts a cookie from the client that contains a session identifier before the user is authenticated. The cookie, if it contains a valid name, is preserved after a successful login, allowing an attacker who has set that cookie to hijack the session of the authenticated user. This is a classic session‑fixation flaw (CWE‑384) and provides a path to unauthorized account access but does not allow code execution or data modification outside the hijacked session.

The vulnerability is present in all releases of KTM System e‑BOK before the June 2026 patch. No precise version numbers are listed in the advisory, so any older deployment of the online client service portal is potentially affected.

The CVSS score of 4.8 denotes moderate severity, reflecting the requirement for user authentication to exploit the fault. The EPSS score is not available, so evidence of exploitation frequency is unknown, yet session‑fixation attacks are well known and can be automated against publicly reachable sites. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to trick a victim into visiting the site or otherwise having the attacker set the session cookie before login; after the victim logs in, the attacker can use the unchanged cookie to gain access to the victim’s account.