Analysis: PHP session forgery exposed 13,000 accounts across tenants

A researcher documented a vulnerability chain in a multi-tenant education platform where an import handler wrote client-supplied data into $_SESSION before the auth check, enabling pre-auth session forgery. A bearer token signed with a secret shared between QA and production granted fleet-wide admin access to 13,000+ accounts, and an SSRF flaw leaked an internal API token.

• Import handler copied the session block from JSON into $_SESSION before the role check
• An HTTP 400 response still set a working support_tool_bearer cookie
• A secret shared between QA and production let QA-minted tokens pass on production
• SSRF exposed the internal support API's own auth token