IBM Planning Analytics CVE-2026-10545

Exploitation requires the crafted open-redirect URL to be processed within an active SSO authentication flow - this is the specific configuration that turns the redirect into session-token exposure per the description; a deployment not using SSO faces only benign off-site redirection. Limiting factors, consistent with CVSS AV:N/AC:H/PR:N/UI:R: the attack is unauthenticated and remote but demands user interaction (the victim must click the crafted link) and high attack complexity (the redirect must coincide with token-bearing SSO steps). Affected build must be Planning Analytics Local 2.1.0-2.1.21.

The CVSS 3.1 base score is 7.5 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - network reachable and unauthenticated, but gated by high attack complexity and required user interaction. The C:H/I:H/A:H impact rating is aggressive for an open redirect and appears to reflect the worst-case SSO session-hijack outcome rather than a direct memory/data-integrity compromise; defenders should treat the availability impact in particular as questionable for this vulnerability class. No EPSS score, KEV listing, SSVC decision, or POC was provided, so exploitation-probability signals are absent. Realistically this is a phishing-dependent, conditionally-exploitable issue: meaningful impact requires both an SSO deployment and a user being socially engineered into clicking a crafted link, which places it below a wormable or automatable network flaw despite the 7.5 rating. Missing EPSS/KEV data means widespread active exploitation cannot be confirmed or ruled out from the inputs.

An attacker crafts a Planning Analytics URL whose redirect parameter points to an attacker-controlled site and delivers it to a targeted user via phishing. When the user, mid-SSO-authentication, follows the link, the application redirects them off-domain and the session token or authorization code is captured by the attacker's server, who then replays it to hijack the user's authenticated session. The AC:H/UI:R vector means success depends on the SSO flow timing and on the victim clicking the link.