IBM DevOps Automation CVE-2025-36359

Exploitation requires that the attacker already holds valid authentication to the platform (PR:L) and obtains a victim's session ID that has reached its intended expiration but is still accepted by the server. The core flaw is that expired session IDs are not invalidated, so the limiting factor is access to such a token (via shared or logged-out sessions, captured identifiers, or reuse) rather than any special product feature flag or non-default setting. Limiting factors: the attacker must be authenticated, must acquire the target's session identifier, and the impact is confined to confidentiality and integrity (A:N) with no availability or denial-of-service angle.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates network-reachable, low-complexity exploitation by an already-authenticated low-privilege user, with high confidentiality and integrity impact but no availability impact - consistent with account impersonation rather than service disruption. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit was identified, so practical risk is moderated by the PR:L requirement: the attacker must already hold valid credentials and must also obtain another user's (expired) session token. There is no signal of active or widespread exploitation, so this is a meaningful but not emergency patch priority. Note the high base score is driven by the impersonation impact, not by the ease of obtaining the victim's token - a step the vector does not separately capture.

An authenticated low-privilege user of IBM DevOps Automation captures or retains another user's session identifier - for example one that should have been invalidated after timeout - and replays it against the application. Because the server still accepts the expired ID, the attacker is authenticated as the victim and performs actions under that identity, reaching pipelines and data they should not control. No public proof-of-concept exists at time of analysis.