CVE-2026-5514
IBM Bob is vulnerable to unauthorized session token exposure due to improper handling of authentication provider session information
CVSS Score
3.3
EPSS Score
0.0%
EPSS Percentile
0th
IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.
| CWE | CWE-200 |
| Vendor | ibm |
| Product | bob |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for ibm bob
Be the first to know when new low vulnerabilities affecting ibm bob are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
IBM / Bob
2.0.3