Executive brief
KTM System e-BOK is a web portal used by housing cooperatives to allow residents to view personal data, billing information, and payment history. A security flaw allows an attacker to fix a user's session ID before they log in, which can lead to the attacker hijacking the user's account once they authenticate. This could result in unauthorized access to a resident's financial records, personal details, and account settings.
Technical details
A session fixation vulnerability (CWE-384) exists in KTM System e-BOK because the application allows the client to set a session identifier prior to authentication. If a cookie with a valid name is provided by the client, the application fails to regenerate the session ID upon a successful login, maintaining the pre-authentication value. An attacker can exploit this by forcing a specific session ID on a victim's browser (e.g., via physical access or local network manipulation) and then hijacking the session once the victim logs in. The issue was addressed in the June 2026 patch.
Affected products
- KTM System e-BOK All versions prior to June 2026 update
Timeline
- 2026-06-30: advisory: Advisory published by CERT.PL
- 2026-06-30: disclosed
- 2026-06-01: patched: Patch released in June 2026