---
id: "CVE-2026-5514"
page: "https://infrastack.ai/live/CVE-2026-5514"
kind: "vulnerability"
aliases: ["CVE-2026-5514"]
title: "IBM Bob: extensions can read session tokens through the authentication provider API"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "IBM Bob IDE", "fixed": ["2.0.4"], "affected": "2.0.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-tooling", "extensions", "ibm-bob", "vscode"]
not_affected_if: ["no-extensions-installed"]
published_at: "2026-11-13T22:17:25+00:00"
first_seen_at: "2026-11-13T22:33:35+00:00"
updated_at: "2026-11-13T22:36:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5514", "first_seen_at": "2026-11-13T22:33:35+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/node/7296454", "first_seen_at": "2026-11-13T22:36:20+00:00", "cites": ["https://www.ibm.com/support/pages/node/7296454"]}]
exploit_sources: []
---

# IBM Bob: extensions can read session tokens through the authentication provider API

Link for people: https://infrastack.ai/live/CVE-2026-5514 (this .md is for agents)

IBM Bob 2.0.3 exposes a session token in the account identifier field during account enumeration, so any installed extension can read it without user consent. A malicious extension could use that token to act as the user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Bob IDE affected 2.0.3 fixed 2.0.4

## How to check

Check the installed IBM Bob IDE version; 2.0.3 is affected, upgrade to 2.0.4. Also review installed VS Code extensions in Bob you do not trust.

## Fix

Upgrade IBM Bob IDE to 2.0.4

## Timeline

- 2026-11-13T22:33:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-5514
- 2026-11-13T22:36:20+00:00 analyst https://www.ibm.com/support/pages/node/7296454 — IBM bulletin 7296454 read: IBM Bob IDE 2.0.3 affected, fixed in 2.0.4, no workarounds. IBM CVSS 5.5 vs NVD CNA 3.3; severity left low. No exploitation or PoC seen; no social search done (low tier B).

## Documents

- [advisory] IBM Security Bulletin: IBM Bob session token exposure (CVE-2026-5514) https://www.ibm.com/support/pages/node/7296454

## From the sources

IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_