Unauthorized Access Vulnerability in IBM Bob 2.0.3
CVE-2026-5514

3.3LOW

Key Information:

Vendor

IBM
Status
Bob
Vendor
CVE Published:
13 November 2026

What is CVE-2026-5514?

IBM Bob version 2.0.3 is vulnerable to an unauthorized access issue where malicious extensions can retrieve session tokens via the authentication provider API. This exposure occurs without explicit user consent, as session tokens are visible in the account identifier field during account enumeration. Consequently, this could potentially enable attackers to perform unauthorized actions on behalf of the user, increasing the risk of compromise of sensitive information. It is crucial for users to apply necessary patches to mitigate this vulnerability.

Affected Version(s)

Bob 2.0.3

References

https://www.ibm.com/support/pages/node/7296454
vendor-advisorypatch

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.