XSS Vulnerability in IBM Concert Affects Multiple Versions
CVE-2026-4413

6.1MEDIUM

Key Information:

Vendor

IBM
Status
Concert
Vendor
CVE Published:
19 October 2026

What is CVE-2026-4413?

IBM Concert versions 1.0 through 3.0.0 are susceptible to a cross-site scripting (XSS) vulnerability. This security flaw enables an unauthenticated attacker to inject arbitrary JavaScript into the Web UI, which could compromise the intended functionality of the application. Such manipulation may result in the unauthorized disclosure of user credentials within a trusted session, posing significant risks to user data and application integrity.

Affected Version(s)

Concert 1.0.0 <= 3.0.0

References

https://www.ibm.com/support/pages/node/7292374
vendor-advisorypatch

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.