CVE-2025-36359

HIGH

IBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.

Title source: cna
STIX 2.1

Description

IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7277970

Scores

CVSS v3 8.1
EPSS 0.0019
EPSS Percentile 8.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-613
Status published
Products (4)
IBM/DevOps Automation 1.0.1
IBM/DevOps Loop 1.0.2
ibm/devops_automation 1.0.1
ibm/devops_loop 1.0.2
Published Jun 30, 2026
Tracked Since Jul 01, 2026