A session fixation flaw is present in osTicket version 1.18.2. The application fails to invalidate the pre‑authentication cookie or create a new session identifier after the user logs in. If an attacker can set a known session ID in the victim’s browser, the victim’s authenticated session will reuse that ID, allowing the attacker to maintain unauthorized access. This flaw permits session hijacking and potential misuse of the victim’s account privileges.

The vulnerability impacts the legacy Enhancesoft:osTicket platform, specifically the 1.18.2 release. The current code base is in maintenance mode, and Enhancesoft is focusing on a complete rewrite (v2.0). No patch is available for the legacy version and updates are significantly delayed.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1% shows a very low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to set a known session identifier in the victim’s browser before authentication, implying a web‑based attack vector that may be facilitated by phishing or social engineering. Given that the application does not regenerate session IDs on login, once the victim authenticates the attacker can hijack the session without further privileged actions.