Exploiting CVE-2026-102489: Zammad WebSocket Session Hijacking

Campaign or TTP Overview

CVE-2026-102489 is a newly discovered vulnerability affecting the Zammad ticketing system platform. It primarily involves the exploitation of WebSocket errors, allowing attackers to hijack user sessions without authentication. This vulnerability was first observed and documented in October 2023. While the specific threat actors behind exploiting this vulnerability have not been identified, the impact spans globally across organizations using Zammad for customer support and internal ticketing processes.

The vulnerability lies in how Zammad handles WebSocket connections. A flaw in the application logic enables an unauthenticated user to induce error responses that inadvertently leak session cookies. With these cookies, an attacker can assume the session of a legitimate user, potentially escalating their access to include privileged operations. If administrative access is secured, the outcome can include unauthorized modifications and even remote code execution.

How It Was Built

The infrastructure setup for this attack requires only minimal resources, making it appealing to a wide range of threat actors. Attackers typically deploy a server capable of intercepting WebSocket communications between the Zammad client and server. They leverage tools capable of monitoring and generating WebSocket connections to the Zammad instance.


GET /ws/ HTTP/1.1

Host: vulnerable-zammad-instance.com

Upgrade: websocket

Connection: Upgrade

Sec-WebSocket-Key: x3JJHM2/jXA3QZH6KOE/a==

By sending crafted WebSocket requests, attackers can trigger specific error conditions. A critical observation here is the session cookie exposure via error handling messages. These messages contain the session cookie required to hijack a valid user session.

Post-cookie capture, attackers can easily inject themselves into an active session using browser developer tools or specialized session hijacking payloads tailored to automate this process. This simple, yet effective, vector scales rapidly as it exploits a fundamental security design oversight within the application’s WebSocket architecture.

Why It Worked

Unauthenticated access to WebSocket connections is the cornerstone of this exploitation’s success. The WebSocket protocol in Zammad is improperly guarded, allowing anyone to induce and witness sensitive error messages that typically should be secured. Furthermore, the error messages themselves are verbose enough to include sensitive data, such as session cookies.

In addition, the ease of setup plays a crucial role. Attackers do not require high complexity infrastructure or deep technical skills to execute this attack, just basic knowledge of WebSocket communication patterns and session management.

Lax session management policies in many Zammad deployments exacerbate the issue. Many administrators fail to enforce stringent session end-points such as session expiration times or IP change limits, giving attackers a broad attack window to work within.

Operator Takeaways

As a red teamer, this vulnerability offers several insights and opportunities to refine your engagement strategies. First, you can replicate the exploit scenario to assess and illuminate the weaknesses in WebSocket management within applications under evaluation. By demonstrating a real-world session hijack, you can provide compelling proof of a security gap that may motivate immediate hardening and patch management.

Furthermore, consider diversifying your attack vectors. Use this approach to remind stakeholders of the importance of holistic security assessments. For instance, by mimicking genuine employee interactions over compromised sessions, you can assess social engineering resilience in parallel with technical security measures.

Good / Better / Best

Good: Leverage basic tools to initiate WebSocket connections and observe session cookies in unpatched environments. This can highlight existing gaps but does not provide insights into broader attack surfaces.

Better: Incorporate session hijacking into a broader penetration test, coupling it with social engineering elements and authorization boundary testing for a truthful organizational security posture review.

Best: Develop custom payloads that tap into unencrypted WebSocket sessions, offering enhanced speed and stealth in session analysis. Complement technical tests with user behavior analytics to assess how well users can spot anomalous activity originating from compromised accounts.

References

Horizon3.ai CVE Details

MITRE CVE-2026-102489 Page