{"id":"CVE-2026-5514","kind":"vulnerability","aliases":["CVE-2026-5514"],"related":[],"title":"IBM Bob: extensions can read session tokens through the authentication provider API","description":"IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.","summary":"IBM Bob 2.0.3 exposes a session token in the account identifier field during account enumeration, so any installed extension can read it without user consent. A malicious extension could use that token to act as the user.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Bob IDE","fixed":["2.0.4"],"affected":"2.0.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","extensions","ibm-bob","vscode"],"not_affected_if":["no-extensions-installed"],"how_to_check":"Check the installed IBM Bob IDE version; 2.0.3 is affected, upgrade to 2.0.4. Also review installed VS Code extensions in Bob you do not trust.","fix":"Upgrade IBM Bob IDE to 2.0.4","status":"open","published_at":"2026-11-13T22:17:25+00:00","first_seen_at":"2026-11-13T22:33:35+00:00","triaged_at":"2026-11-13T22:34:46+00:00","updated_at":"2026-11-13T22:36:20+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-11-13T22:34:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"IBM Bob: extensions can read session tokens through the authentication provider API","impact":"high","summary":"IBM Bob 2.0.3 exposes a session token in the account identifier field during account enumeration, so any installed extension can read it without user consent. A malicious extension could use that token to act as the user.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["ibm-bob","ai-tooling","extensions"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"malicious extension takes over the user's session","analyst_note":"Confirm the fixed version and any mitigation from IBM's bulletin for CVE-2026-5514; the NVD entry lists no fix.","how_to_check":"- Check the installed IBM Bob version (`2.0.3` is affected per the advisory summary)\n- Review installed Bob extensions for any you do not trust\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-extensions-installed"],"who_is_affected":"Teams running IBM Bob 2.0.3 with extensions installed are exposed, since an extension can enumerate accounts and read the token. Users who do not use extensions in Bob have less exposure. The sources do not name a fixed version or a setting.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":4566,"output_tokens":501,"severity_before":"low"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any mitigation from IBM's bulletin for CVE-2026-5514; the NVD entry lists no fix.","search":"'-2026':14A,17A '-5514':15A,18A '2.0.3':32B,69C 'access':105C 'account':39B,43B,88C,92C 'act':63B 'action':113C 'ai':23B 'ai-tool':22B 'allow':70C,101C 'api':12A,81C 'authent':10A,79C 'behalf':115C 'bob':2A,20A,28B,31B,68C 'consent':54B,98C 'could':58B 'cve':13A,16A 'enumer':44B,93C 'explicit':96C 'expos':33B,85C 'extens':3A,25B,48B,57B,72C,103C 'field':41B,90C 'ibm':1A,19A,27B,30B,67C 'ibm-bob':26B 'ide':21A 'identifi':40B,89C 'inform':108C 'instal':47B 'malici':56B,102C 'may':100C 'perform':111C 'potenti':110C 'provid':11A,80C 'read':5A,50B 'requir':95C 'retriev':74C 'sensit':106C 'session':6A,35B,75C,107C 'token':7A,36B,61B,76C,83C 'tool':24B 'unauthor':71C,112C 'use':59B 'user':53B,66B,97C,118C 'via':77C 'vscode':29B 'without':52B,94C","nicknames":[],"mitigations":[],"who_affected":"IBM Bob IDE 2.0.3 exposes a session token to any installed extension through the account enumeration API, with no consent prompt. Only teams running Bob IDE 2.0.3 with extensions they do not fully trust are realistically exposed; those on 2.0.4 or with no extensions can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T22:36:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296454","run_id":3940},"products":{"at":"2026-11-13T22:36:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296454","run_id":3940},"mitigations":{"at":"2026-11-13T22:36:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296454","run_id":3940},"workarounds":{"at":"2026-11-13T22:36:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296454","run_id":3940},"how_to_check":{"at":"2026-11-13T22:36:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296454","run_id":3940},"who_affected":{"at":"2026-11-13T22:36:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296454","run_id":3940}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["bobide","ibmbobide"],"ptokens":["bob","ibm","ide"],"labels":["aitooling","extensions","ibmbob","low","vscode"],"campaign_type":null,"search_a":"'-2026':14A,17A '-5514':15A,18A 'api':12A 'authent':10A 'bob':2A,20A 'cve':13A,16A 'extens':3A 'ibm':1A,19A 'ide':21A 'provid':11A 'read':5A 'session':6A 'token':7A","search_b":"'2.0.3':32B 'account':39B,43B 'act':63B 'ai':23B 'ai-tool':22B 'bob':28B,31B 'consent':54B 'could':58B 'enumer':44B 'expos':33B 'extens':25B,48B,57B 'field':41B 'ibm':27B,30B 'ibm-bob':26B 'identifi':40B 'instal':47B 'malici':56B 'read':50B 'session':35B 'token':36B,61B 'tool':24B 'use':59B 'user':53B,66B 'vscode':29B 'without':52B","search_c":"'2.0.3':69C 'access':105C 'account':88C,92C 'action':113C 'allow':70C,101C 'api':81C 'authent':79C 'behalf':115C 'bob':68C 'consent':98C 'enumer':93C 'explicit':96C 'expos':85C 'extens':72C,103C 'field':90C 'ibm':67C 'identifi':89C 'inform':108C 'malici':102C 'may':100C 'perform':111C 'potenti':110C 'provid':80C 'requir':95C 'retriev':74C 'sensit':106C 'session':75C,107C 'token':76C,83C 'unauthor':71C,112C 'user':97C,118C 'via':77C 'without':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-5514","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5514","severity":null,"published_at":"2026-11-13T22:17:25+00:00","modified_at":"2026-11-13T22:17:25+00:00","first_seen_at":"2026-11-13T22:33:35+00:00","fetched_at":"2026-11-13T22:33:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-5514:3940","url":"https://www.ibm.com/support/pages/node/7296454","severity":null,"published_at":"2026-11-13T22:36:20+00:00","modified_at":"2026-11-13T22:36:20+00:00","first_seen_at":"2026-11-13T22:36:20+00:00","fetched_at":"2026-11-13T22:36:20+00:00","note":"IBM bulletin 7296454 read: IBM Bob IDE 2.0.3 affected, fixed in 2.0.4, no workarounds. IBM CVSS 5.5 vs NVD CNA 3.3; severity left low. No exploitation or PoC seen; no social search done (low tier B).","cites":["https://www.ibm.com/support/pages/node/7296454"]}],"documents":[{"id":150669,"url":"https://www.ibm.com/support/pages/node/7296454","title":"IBM Security Bulletin: IBM Bob session token exposure (CVE-2026-5514)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}