Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Bob by IBM
CVE-2026-5514 (GCVE-0-2026-5514)
Vulnerability from nvd – Published: 2026-11-13 21:51 – Updated: 2026-11-13 21:51
VLAI
EPSS
VEX
Title
IBM Bob is vulnerable to unauthorized session token exposure due to improper handling of authentication provider session information
Summary
IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.
Severity
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7296454 | vendor-advisorypatch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:bob:2.0.3:*:*:*:*:*:*:*"
],
"product": "Bob",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.\u003c/p\u003e"
}
],
"value": "IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:51:23.679Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7296454"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to the latest IBM Bob to \u003ca href=\"https://internal.bob.ibm.com/docs/ide/getting-started/install#download-ibm-bob-1\" rel=\"nofollow\"\u003eV 2.0.4\u003c/a\u003e\u003c/p\u003e\u003cp\u003eWe recommend reviewing the documentation for guidance on installing\u00a0\u003ca href=\"https://internal.bob.ibm.com/docs/ide\" rel=\"nofollow\"\u003eIBM Bob IDE\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to the latest IBM Bob to V 2.0.4 https://internal.bob.ibm.com/docs/ide/getting-started/install#download-ibm-bob-1 \n\n\n\nWe recommend reviewing the documentation for guidance on installing\u00a0 IBM Bob IDE https://internal.bob.ibm.com/docs/ide"
}
],
"title": "IBM Bob is vulnerable to unauthorized session token exposure due to improper handling of authentication provider session information"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-5514",
"datePublished": "2026-11-13T21:51:23.679Z",
"dateReserved": "2026-04-03T21:10:16.398Z",
"dateUpdated": "2026-11-13T21:51:23.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5514 (GCVE-0-2026-5514)
Vulnerability from cvelistv5 – Published: 2026-11-13 21:51 – Updated: 2026-11-13 21:51
VLAI
EPSS
VEX
Title
IBM Bob is vulnerable to unauthorized session token exposure due to improper handling of authentication provider session information
Summary
IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.
Severity
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7296454 | vendor-advisorypatch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:bob:2.0.3:*:*:*:*:*:*:*"
],
"product": "Bob",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.\u003c/p\u003e"
}
],
"value": "IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:51:23.679Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7296454"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to the latest IBM Bob to \u003ca href=\"https://internal.bob.ibm.com/docs/ide/getting-started/install#download-ibm-bob-1\" rel=\"nofollow\"\u003eV 2.0.4\u003c/a\u003e\u003c/p\u003e\u003cp\u003eWe recommend reviewing the documentation for guidance on installing\u00a0\u003ca href=\"https://internal.bob.ibm.com/docs/ide\" rel=\"nofollow\"\u003eIBM Bob IDE\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to the latest IBM Bob to V 2.0.4 https://internal.bob.ibm.com/docs/ide/getting-started/install#download-ibm-bob-1 \n\n\n\nWe recommend reviewing the documentation for guidance on installing\u00a0 IBM Bob IDE https://internal.bob.ibm.com/docs/ide"
}
],
"title": "IBM Bob is vulnerable to unauthorized session token exposure due to improper handling of authentication provider session information"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-5514",
"datePublished": "2026-11-13T21:51:23.679Z",
"dateReserved": "2026-04-03T21:10:16.398Z",
"dateUpdated": "2026-11-13T21:51:23.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}