CVE-2025-36359CWE-613

CVE-2025-36359

High · published July 1, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
24.7
In the wild
Unconfirmed
What it is

IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00329 · 24.7th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-07-01T01:16Z
Affected products (2)
ProductVersionsFixed in
ibm/devops_automationall versions—
ibm/devops_loopall versions—
References (1)
https://www.ibm.com/support/pages/node/7277970 · [email protected]
EPSS history
Timeline
  • 30 JUN 20:11Z
    IBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.
    cvelistv5