CVE-2026-9825: IBM Cyber Fraud Reachable Assertion
IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
Other sources
IBM Cyberfraud has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Cyber Fraudto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
Which deployments are affected?
IBM Cyber Fraud versions 1.0.0 through 1.0.2 are affected.
What does an attacker need to exploit this issue?
An attacker needs the ability to conduct a network-based attack and intercept traffic sent over an unencrypted connection. No privileges or user interaction are required, but the attack complexity is rated high.
What information could be exposed?
Sensitive cookies may be transmitted without the secure attribute over unencrypted connections, which could allow interception of session data. The reported impact is limited to confidentiality; integrity and availability are not affected.