CVE-2026-9825
LowCVSS 3.7Summary
IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
Risk Assessment
Interception of session cookies may allow an attacker to hijack a user session and gain unauthorized access to the application.
Recommendation
Update IBM Cyber Fraud to a version containing the fix or configure cookies with the Secure attribute and enforce HTTPS communication.
Other vulnerabilities in IBM Cyber Fraud
Original NVD description (English source)
IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS