Mario Valiente

**Name of the Vulnerable Software and Affected Versions** osTicket version 1.18.2 **Description** A session fixation flaw allows an attacker to hijack a user account by ensuring the initial session identifier `OSTSESSID` remains active after a successful login. The application fails to invalidate the pre-authentication cookie or generate a new identifier for the authenticated context. Consequently, if an attacker sets a known session identifier in a victim's browser, they can maintain unauthorized access once the victim authenticates. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.