{"affected":[{"product":"Bob","source":"CNA: ibm","vendor":"IBM","versions":[{"status":"affected","version":"2.0.3"}]}],"cveId":"CVE-2026-5514","cwes":["CWE-200"],"description":"IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":3.3,"severity":"low","source":"CNA: ibm","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},{"score":3.3,"severity":"low","source":"NVD: psirt@us.ibm.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794608245397,"publishedAt":1794606683679,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7296454"},{"source":"psirt@us.ibm.com","tags":[],"url":"https://www.ibm.com/support/pages/node/7296454"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"IBM strongly recommends addressing the vulnerability now by upgrading to the latest IBM Bob to  V 2.0.4 https://internal.bob.ibm.com/docs/ide/getting-started/install#download-ibm-bob-1 \n\n\n\nWe recommend reviewing the documentation for guidance on installing  IBM Bob IDE https://internal.bob.ibm.com/docs/ide"},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7296454"}],"revision":"6c63f8be19be1718e3705dafdd5779eab8a7df8120c0d091cfe296dc59f993c6","sources":[{"modifiedAt":1794606683679,"name":"CNA: ibm","retrievedAt":1794607795023,"url":"https://www.cve.org/CVERecord?id=CVE-2026-5514"},{"modifiedAt":1794608245397,"name":"NVD","retrievedAt":1794615617338,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5514"}],"ssvc":null,"status":"published","title":"IBM Bob is vulnerable to unauthorized session token exposure due to improper handling of authentication provider session information","updatedAt":1794615617338}