IBM Maximo Application Suite Sensitive Tokens without 'Secure' Attribute
view advisory published 2026-04-07
IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. An unauthenticated attacker can steal cookies by directing users to a malicious http:// link and snooping user traffic.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-4820US | —OT elevated | — | ||
IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values b… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (1)
- FixedMaximo Application Suite
Fixed in 9.1.8, 9.0.19, 8.11.30, and 8.10.33.
https://www.ibm.com/support/pages/node/7268028/
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan