Session Fixation in IBM DevOps Automation

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: IBM Corporation

Description

IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2025-36359

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	devops_automation	1.0.1
ibm	devops_loop	1.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability exists in IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 where the system does not invalidate session IDs after they expire.

Because of this, an authenticated user could potentially reuse an expired session ID to impersonate another user on the system.

Impact Analysis

The vulnerability could allow an authenticated user to impersonate another user, potentially gaining unauthorized access to that user's privileges and data.

This could lead to unauthorized actions being performed on the system under the guise of the impersonated user.

Hi! I’m here to help you understand CVE-2025-36359. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70