Jacek Korta

**Name of the Vulnerable Software and Affected Versions** KTM System e-BOK (affected versions not specified) **Description** KTM System e-BOK allows the session identifier to be set by the client before authentication. If a cookie with a valid name is provided, the system does not change its value after a successful login. This behavior allows an attacker to perform session fixation, where a specific session ID is forced upon a victim, enabling the attacker to hijack the authenticated session. **Recommendations** Apply the patch published in June 2026.

**Name of the Vulnerable Software and Affected Versions** KTM System e-BOK (affected versions not specified) **Description** Cross-Site Request Forgery (CSRF) exists in the email-change and password-change functionalities. This occurs when an attacker crafts a malicious website that, when visited by an authenticated user, automatically sends a forged POST request to the application. This allows the attacker to trigger an unauthorized email or password change on behalf of the victim without their knowledge or interaction. **Recommendations** Apply the patch published in June 2026.

**Name of the Vulnerable Software and Affected Versions** KTM System e-BOK (affected versions not specified) **Description** The system enforces a weak password policy by limiting passwords to a maximum of six numeric digits and prohibiting the use of alphabetic, special, or extended characters. **Recommendations** Apply the patch published in June 2026.

KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accounts. When combined with vulnerability CVE-2026-35097, where passwords are restricted to a six‑digit numeric format, this becomes a critical issue, as such passwords can be brute‑forced in a relatively short time. This issue was fixed in the patch published in June 2026.