EUVD-2026-106867
GHSA-7xgv-rp93-55qp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain man-in-the-middle network position
-
ExploitInduce or observe cleartext HTTP request
-
ExecutionIntercept session cookie lacking Secure flag
-
ImpactReplay cookie to hijack session
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires the attacker to hold a man-in-the-middle position on the network path to an IBM Cyber Fraud (1.0.0-1.0.2) instance AND for the victim's session cookie to actually be transmitted over an unencrypted HTTP connection - the missing Secure attribute only exposes the cookie when the application is reached over HTTP rather than HTTPS. Limiting factors that reduce real-world risk: deployments that enforce HTTPS/HSTS end-to-end largely neutralize the flaw, no authentication is bypassed by the vulnerability itself (it enables session-cookie capture, not direct access), and the attacker must already have network-interception capability, which is why CVSS rates this AC:H with only low confidentiality impact. |
| Impact | This is a genuinely low-priority issue despite being network-reachable. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7) shows no authentication needed (PR:N) and no user interaction, but high attack complexity (AC:H) and only low confidentiality impact (C:L), with zero integrity or availability impact. The AC:H rating is well-justified: the attacker must already occupy a privileged network position to intercept traffic AND the session must traverse an unencrypted channel for the missing Secure cookie attribute to matter. No EPSS score, KEV listing, or POC availability is provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent - a low-severity information-exposure weakness with meaningful preconditions, not a high-CVSS-but-low-risk anomaly nor an under-rated sleeper. One data note: the input lists CWE-617 (Reachable Assertion), which does not match the described weakness (a missing Secure cookie attribute, properly CWE-614); treat the CWE mapping as likely mislabeled and rely on the description. |
| Exploit ScenarioDerived | An attacker positioned on the network path between a user and IBM Cyber Fraud (e.g., shared Wi-Fi, a compromised router, or ARP spoofing on a LAN) waits for the victim's browser to send a session cookie over an unencrypted HTTP connection, which occurs because the cookie lacks the Secure attribute. The attacker captures the cookie in transit and replays it to hijack the authenticated session. No public exploit code is referenced, and the high attack complexity reflects the need for both a network foothold and an unencrypted request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
IBM Cyber Fraud versions 1.0.0 through 1.0.2 issue session cookies without the Secure attribute, so a remote, unauthenticated attacker who already sits in a man-in-the-middle position on the network path can capture session data whenever the application is reached over plain HTTP (CVSS 3.7, AC:H, low confidentiality impact only). The flaw does not bypass authentication or grant direct access; it only widens exposure of cookies that are transmitted unencrypted. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and deployments that enforce HTTPS/HSTS end-to-end largely neutralize the issue.
RemediationAI
No vendor-released patch or fixed version was identified in the available data at time of analysis, so the primary action is to confirm status with IBM via advisory node 7290671 (https://www.ibm.com/support/pages/node/7290671) and apply any fix level IBM publishes. In the interim, configure the application or its fronting reverse proxy to append the Secure attribute to all session cookies (and use the __Host- cookie name prefix where feasible), which prevents the browser from ever sending them over HTTP; the trade-off is that any legitimate HTTP-only access path will stop authenticating users and must be migrated to HTTPS. Enforce HTTPS end-to-end with HSTS, including a redirect from port 80 to 443 and HSTS preload only after all subdomains are confirmed TLS-capable, since an over-broad HSTS policy can lock out legacy clients or internal HTTP services. Where the application cannot set cookie flags directly, rewrite Set-Cookie headers at the load balancer or WAF, accepting the added operational complexity and the risk of missing dynamically generated cookies. Finally, restrict cookie Domain and Path scope to the minimum necessary and monitor for cleartext HTTP requests carrying session cookies, treating them as evidence of either misconfiguration or interception attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a missing cookie security attribute: session cookies set by IBM Cyber Fraud 1.0.0-1.0.2 lack the Secure flag, which instructs browsers to send the cookie only over TLS-protected connections. Without it, a browser will attach the cookie to an HTTP request, allowing an attacker with network interception capability (same wireless network, ARP/DNS spoofing, hostile proxy, or compromised router) to read the session identifier in cleartext and replay it. Exploitation is therefore conditional on two things occurring together: the victim's traffic actually traversing an unencrypted HTTP hop, and the attacker already being positioned to observe that traffic - which is why the assessed vector is AC:H with only C:L and no integrity or availability impact. Note that the supplied CWE-617 (Reachable Assertion) does not describe this behavior; the appropriate classification is a missing security attribute for a cookie (CWE-614/CWE-1004 class), and the analysis here follows the observed behavior rather than the mismatched CWE label. No CPE strings were provided, so affected-scope confirmation rests on the vendor's version range (1.0.0 through 1.0.2) and IBM advisory node 7290671.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no auth (PR:N), but AC:H because the attacker needs a MITM position and an unencrypted request; only cookie confidentiality is affected (C:L), no I/A impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB