CVE-2026-15656: IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret
IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Other sources
IBM Maximo Application Suite does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Maximo Application Suiteto a version that resolves this vulnerability.Fixed in 9.2.1 - Upgrade
Upgrade
IBM Maximo Application Suiteto a version that resolves this vulnerability.Fixed in 9.1.20 - Upgrade
Upgrade
IBM Maximo Application Suiteto a version that resolves this vulnerability.Fixed in 9.0.28 - Configuration
Ensure IBM MAS sets the Secure attribute on the mas-redirect-uri cookie and on authorization tokens and session cookies (so cookies are not sent over insecure HTTP links).
IBM Maximo Application Suite (mas-redirect-uri cookie / authorization tokens / session cookies) Secure attribute = enabled - Compensating control
Prevent users from following insecure HTTP links to IBM MAS by blocking HTTP access and enforcing HTTPS for the relevant MAS endpoints.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15656?
The severity of CVE-2026-15656 is rated as medium with a score of 4.3.
How do I fix CVE-2026-15656?
To fix CVE-2026-15656, ensure that the secure attribute is set on all authorization tokens and session cookies in IBM Maximo Application Suite.
What vulnerabilities are associated with CVE-2026-15656?
CVE-2026-15656 is linked to vulnerabilities such as missing secure attributes on cookies and weak HMAC session secrets.
What software is affected by CVE-2026-15656?
CVE-2026-15656 affects IBM Maximo Application Suite versions 9.2, 9.1, and 9.0.
How can attackers exploit CVE-2026-15656?
Attackers can exploit CVE-2026-15656 by sending a user an insecure link that captures authorization tokens or session cookie values.