CVE-2026-35096: KTM System e-BOK CSRF Vulnerability

CVE-2026-35096 Overview

CVE-2026-35096 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the KTM System e-BOK online client services application. The flaw exists in both the email-change and password-change functionalities. An attacker can craft a malicious website that triggers forged POST requests when visited by an authenticated user. This action changes the victim's email address or password without their knowledge or consent. The vulnerability is tracked under CWE-352 and was fixed in a patch published in June 2026.

Critical Impact
An attacker who lures an authenticated e-BOK user to a malicious page can hijack the victim's account by silently changing the email or password, enabling full account takeover.

Affected Products

KTM System e-BOK (Internetowe Biuro Obsługi Klienta) — versions prior to the June 2026 patch

Discovery Timeline

2026-06-30 - CVE-2026-35096 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-35096

Vulnerability Analysis

The KTM System e-BOK application processes sensitive state-changing requests without verifying that the request originated from a legitimate user interaction. The email-change and password-change endpoints accept authenticated POST requests based solely on the session cookie automatically sent by the browser. No anti-CSRF token, origin header validation, or re-authentication challenge is enforced before applying the change.

Because the account recovery flow depends on the registered email, an attacker who changes the victim's email can subsequently trigger a password reset and take full control of the account. The password-change endpoint is directly exploitable in the same manner when the attacker forces submission of a new password value.

Exploitation requires user interaction, since the victim must visit an attacker-controlled page while holding an active e-BOK session. No privileges are required by the attacker, and the attack is delivered over the network.

Root Cause

The root cause is the absence of Cross-Site Request Forgery protections on state-changing endpoints. The application does not implement per-session or per-request CSRF tokens, does not validate the Origin or Referer headers, and does not require the SameSite cookie attribute to restrict cross-origin cookie transmission. Sensitive operations rely exclusively on ambient session authentication.

Attack Vector

The attacker hosts a page containing an auto-submitting HTML form or a scripted fetch call targeting the vulnerable e-BOK endpoint. When an authenticated victim visits the page, the browser attaches session cookies and submits the forged POST request. The server processes the request as legitimate and updates the victim's email address or password. See the CERT Poland advisory for related technical context on the KTM System e-BOK vulnerability class.

Detection Methods for CVE-2026-35096

Indicators of Compromise

Unexpected email address changes in e-BOK account audit logs without corresponding legitimate user activity.
Password change events immediately followed by login attempts from unfamiliar IP addresses or geolocations.
HTTP POST requests to email-change or password-change endpoints where the Referer or Origin header points to an unrelated third-party domain.

Detection Strategies

Inspect web server access logs for POST requests to account-modification endpoints originating from external referrers.
Correlate account modification events with the user's active session activity to identify actions performed outside normal user interaction patterns.
Alert on rapid sequences of email change followed by password reset requests from the same account.

Monitoring Recommendations

Enable auditing of all account credential modifications with timestamp, source IP, and referring URL captured.
Monitor customer support ticket volume for reports of unauthorized account changes, which often signal active CSRF exploitation campaigns.
Track anomalous cross-origin submissions against authenticated endpoints using a web application firewall.

How to Mitigate CVE-2026-35096

Immediate Actions Required

Apply the vendor patch released by KTM System in June 2026 to all e-BOK deployments.
Force re-authentication and password reset for user accounts showing unexplained credential or email modifications.
Notify e-BOK users of the risk and advise them to log out of active sessions before browsing other sites until patching is confirmed.

Patch Information

The vulnerability was fixed in the patch published by KTM System in June 2026. Administrators should verify with the vendor via the KTMSYSTEM Online Client Services page that their deployment is running the patched release.

Workarounds

Configure session cookies with the SameSite=Strict or SameSite=Lax attribute to prevent cross-site cookie transmission on state-changing requests.
Deploy a web application firewall rule that blocks POST requests to email-change and password-change endpoints when the Origin or Referer header does not match the application's own domain.
Require step-up authentication such as a current password prompt or one-time code before allowing email or password modifications.

bash

# Example WAF rule (ModSecurity) blocking cross-origin POST to sensitive endpoints
SecRule REQUEST_METHOD "@streq POST" \
    "chain,id:1035096,phase:1,deny,status:403,\
     msg:'CSRF: cross-origin POST to e-BOK account endpoint'"
    SecRule REQUEST_URI "@rx ^/(account/email|account/password)$" "chain"
        SecRule REQUEST_HEADERS:Origin "!@rx ^https?://(www\.)?ebok\.example\.local$"