LOWCVSS v3.1 3.3Vulnerability
CVE-2026-5514
IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.
Properties
- Severity
- LOW
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Cvss severity
- LOW
- Cvss score
- 3.3
- Retrieved at
- 2026-11-14T00:50:05+00:00
- Score
- 3.3
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-5514
- Cvss vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-11-14T00:50:05+00:00
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Published at
- 2026-11-13T22:17:25.283
- Last modified
- 2026-11-13T22:17:25.397
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph