CVE-2026-15656
IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
| CWE | CWE-614 |
| Vendor | ibm |
| Product | maximo application suite |
| Published | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for ibm maximo application suite
Be the first to know when new medium vulnerabilities affecting ibm maximo application suite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
IBM / Maximo Application Suite
9.2 9.1 9.0