CVE-2026-9825

Published: Oct 20, 2026Modified: Oct 21, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: psirt@us.ibm.com (Secondary)

Description

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (1)

https://www.ibm.com/support/pages/node/7290671

Source: psirt@us.ibm.com

Timeline

No history available yet.