CVE-2026-10545: IBM Planning Analytics Local is affected by Open Redirect
IBM Cognos TM1 Web (tm1web.html) is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions.
Other sources
IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Planning Analytics Localto a version that resolves this vulnerability.Fixed in 2.1.22 - Compensating control
If IBM Cognos TM1 Web (tm1web.html) is used in SSO authentication flows, ensure redirects are constrained/validated so that users cannot be redirected to arbitrary external websites via crafted URLs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10545?
The severity of CVE-2026-10545 is rated as high with a score of 7.5.
How do I fix CVE-2026-10545?
To fix CVE-2026-10545, update to the latest version of IBM Planning Analytics Local that addresses this vulnerability.
What are the potential risks associated with CVE-2026-10545?
The potential risks include attackers being able to redirect users to arbitrary external sites, leading to session hijacking and exposure of sensitive information.
Is CVE-2026-10545 an open redirect vulnerability?
Yes, CVE-2026-10545 is identified as an open redirect vulnerability in IBM Cognos TM1 Web.
What impact does CVE-2026-10545 have on SSO authentication?
CVE-2026-10545 can compromise SSO authentication flows, increasing the risk of session token exposure and user session hijacking.