EUVD-2026-58454
GHSA-vg5w-cvp2-cj2p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Session token forgery enables user impersonation, warranting C:L over the NVD-assigned C:N; all other metrics align with the network-accessible, no-auth attack model.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key.
AnalysisAI
Session token forgery is possible in IBM Documentation Offline versions 1.0.0 through 1.4.1 because the application uses a hardcoded cryptographic key to generate or validate session tokens. An unauthenticated remote attacker who recovers the embedded key - via binary analysis, decompilation, or source exposure - can craft arbitrary valid session tokens and impersonate any authenticated user without supplying credentials. IBM has released a patch (advisory 7283484); no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
IBM Documentation Offline (CPE: cpe:2.3:a:ibm:documentation_offline:*:*:*:*:*:*:*:*) is an offline documentation delivery platform spanning versions 1.0.0 through 1.4.1. The root cause is CWE-321 (Use of Hard-coded Cryptographic Key): the secret used to sign or verify session tokens is compiled directly into the application rather than generated per-deployment or stored in a configurable secrets store. Because every installation shares the identical key, the secret provides no real isolation - once extracted from any copy of the binary or package, it is universally valid across all deployments. Token-based session security collapses entirely when the signing key is known, as the cryptographic integrity guarantee no longer holds.
RemediationAI
The primary fix is to apply the vendor-released patch per IBM security advisory 7283484 at https://www.ibm.com/support/pages/node/7283484. The advisory should specify the exact patched version of IBM Documentation Offline; consult it directly to confirm the target upgrade version, as the input data confirms a patch is available but does not enumerate the fixed version number. If immediate patching is not feasible, restrict network access to the IBM Documentation Offline instance using host-based firewalls or network segmentation, allowing connections only from trusted source IPs - this limits the pool of attackers who can reach the forged-token endpoint, though it does not eliminate the underlying cryptographic weakness. Note that network restriction alone does not prevent exploitation by already-authenticated users or internal threat actors. Rotating any session tokens or forcing re-authentication after patching is advisable to invalidate tokens potentially forged prior to remediation.
More in Documentation Offline
View allRemote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 allows an attacker to run arbitrary code by abusi
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output writ
Path traversal in IBM Documentation Offline 1.0.0 through 1.4.1 enables unauthenticated remote attackers to read arbitra
Information disclosure in IBM Documentation Offline 1.0.0 through 1.4.1 exposes sensitive documentation content to unaut
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today