PozitifIK Pik Online Authorization Bypass Vulnerability Allowing Account Footprinting and Session Hijacking

A vulnerability in PozitifIK Pik Online, present through March 5, 2025, allows for authorization bypass via user-controlled keys, leading to exposure of private personal information, account footprinting, and session hijacking.

Impact

Exploitation of this vulnerability could result in unauthorized access to user accounts, allowing attackers to hijack sessions and potentially misuse personal information.

Remediation

The vendor has not yet addressed this vulnerability. The National Cyber Incident Response Center (USOM) recommends using an alternative software.