EUVD-2026-58454
GHSA-vg5w-cvp2-cj2p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Session token forgery enables user impersonation, warranting C:L over the NVD-assigned C:N; all other metrics align with the network-accessible, no-auth attack model.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key.
AnalysisAI
Session token forgery is possible in IBM Documentation Offline versions 1.0.0 through 1.4.1 because the application uses a hardcoded cryptographic key to generate or validate session tokens. An unauthenticated remote attacker who recovers the embedded key - via binary analysis, decompilation, or source exposure - can craft arbitrary valid session tokens and impersonate any authenticated user without supplying credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required; the attacker must only have network access to the IBM Documentation Offline web interface (AV:N, PR:N per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3 Medium) rates integrity impact as Low and confidentiality impact as None. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a target organization running IBM Documentation Offline 1.0.0-1.4.1, downloads a copy of the application package from a trial, public source, or compromised instance, and extracts the hardcoded signing key through static binary analysis or decompilation. Using that key, the attacker crafts a session token for a privileged user account and submits it in authenticated requests to the Documentation Offline instance, gaining unauthorized access without ever supplying a password. … |
| Remediation | The primary fix is to apply the vendor-released patch per IBM security advisory 7283484 at https://www.ibm.com/support/pages/node/7283484. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Documentation Offline
View allRemote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 allows an attacker to run arbitrary code by abusi
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output writ
Path traversal in IBM Documentation Offline 1.0.0 through 1.4.1 enables unauthenticated remote attackers to read arbitra
Information disclosure in IBM Documentation Offline 1.0.0 through 1.4.1 exposes sensitive documentation content to unaut
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today