KTM e-BOK flaws enable session hijacking, CSRF
Four vulnerabilities in KTM System e-BOK allow session fixation, CSRF-based account takeover, and trivial brute-force attacks due to six-digit-only passwords with no rate limiting.
CERT Polska coordinated disclosure of four vulnerabilities in KTM System e-BOK software that collectively enable serious authentication bypass and account takeover attacks. CVE-2026-35095 permits client-side session fixation, allowing an attacker to set a session ID before authentication and hijack the victim's session post-login. CVE-2026-35096 enables CSRF attacks against email-change and password-change functions, letting attackers trigger unauthorized modifications when an authenticated user visits a malicious site.
The software's authentication controls are critically weak: CVE-2026-35097 restricts passwords to a maximum of six numeric digits with no alphabetic or special characters permitted, and CVE-2026-35098 implements no rate limiting on login attempts. These two flaws combine to make brute-force attacks trivial, as the entire keyspace of six-digit numeric passwords can be exhausted rapidly without defensive throttling.
The vendor published patches addressing all four issues in June 2026. The vulnerabilities were responsibly reported by Jacek Korta through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Possible Session Fixation via Pre-Set Session Identifier
Detects HTTP requests where a session identifier is supplied as a URL query parameter before authentication, consistent with client-side session fixation attacks against e-BOK-style portals. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible Session Fixation via Pre-Set Session Identifier
id: f697f0c5-3db2-593e-9d8e-bee048d2426c
status: experimental
logsource:
category: webserver
product: generic
detection:
selection:
cs-uri-query|contains:
- sessionid=
- SESSIONID=
- PHPSESSID=
- JSESSIONID=
- sid=
filter:
cs-uri-stem|contains:
- /logout
condition: selection and not filter
falsepositives:
- Legitimate applications that intentionally pass session tokens in URLs for cross-domain
SSO
- Load balancers or CDNs rewriting session cookies into query strings for sticky sessions
level: medium
tags:
- attack.t1539
- attack.credential_access
author: Vorant
Suspicious Cross-Site State-Changing Request Missing Origin or Referer
Detects POST requests to sensitive account-modification endpoints (email/password change) that lack a matching Origin or Referer header, indicative of CSRF exploitation against web session cookies. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Cross-Site State-Changing Request Missing Origin or Referer
id: 453e8fab-20b0-5602-a5fc-146800923b82
status: experimental
logsource:
category: webserver
product: generic
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- /change-email
- /change-password
- /update-account
filter_has_origin:
cs(Origin)|exists: true
filter_has_referer:
cs(Referer)|exists: true
condition: selection and not filter_has_origin and not filter_has_referer
falsepositives:
- Older browsers or privacy plugins that strip Referer/Origin headers on legitimate
same-site requests
- API clients or mobile app backends that legitimately omit browser-style headers
level: medium
tags:
- attack.t1606.001
- attack.defense_evasion
author: Vorant
Rapid Numeric-Only Login Attempts Suggesting Password Brute Force
Flags login POST requests carrying short (<=6 digit) numeric-only password parameters against an authentication endpoint with no lockout response, matching the keyspace-exhaustive brute-force pattern enabled by weak 6-digit-numeric password policy and missing rate limiting; a sustained high rate of such requests from one source/account within a short window should be treated as brute forcing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rapid Numeric-Only Login Attempts Suggesting Password Brute Force
id: 26fda728-dbd4-5a18-938a-89b6ae2edd63
status: experimental
logsource:
category: webserver
product: generic
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- /login
- /logowanie
- /auth
cs-uri-query|re: password=[0-9]{1,6}(&|$)
filter:
sc-status: 200
cs-uri-stem|contains: /logout
condition: selection and not filter
falsepositives:
- Legitimate users retrying a forgotten short numeric PIN a small number of times
- Automated QA/monitoring scripts that repeatedly log in with test numeric credentials
level: high
tags:
- attack.t1110.001
- attack.credential_access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-35095
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free