CVE-2026-15656

IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

• CWE-614

• https://www.ibm.com/support/pages/node/7282362Vendor Advisory

Published

Aug 5, 2026

Last Modified

Aug 10, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15649The Powerkit – Supercharge your WordPress Site plugin for Wo…6.4
• CVE-2026-1565The User Frontend: AI Powered Frontend Posting, User Directo…8.8
• CVE-2026-15650The RT Mega Menu – Mega Menu Builder for Elementor & Gutenbe…6.4
• CVE-2026-15651The WP TripAdvisor Review Slider plugin for WordPress is vul…4.9
• CVE-2026-15652The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Prod…6.4
• CVE-2026-15653The Visualizer – Tables & Charts Manager with Built-in AI Ge…6.4
• CVE-2026-15657A vulnerability in the foreUP customer REST API allows any a…6.5
• CVE-2026-15658A vulnerability in the foreUP customer REST API allows any a…8.1
• CVE-2026-1566The LatePoint – Calendar Booking Plugin for Appointments and…8.8
• CVE-2026-15660The SEO Booster plugin for WordPress is vulnerable to Missin…4.3
• CVE-2026-15662The Advanced Woo Labels – Product Labels & Badges for WooCom…6.4
• CVE-2026-15663The Ninja Forms – The Contact Form Builder That Grows With Y…4.9