EUVD-2026-125813

IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session...

CVE-2026-5514

The IBM Bob IDE (version 2.0.3 ) is vulnerable to an information disclosure flaw (CWE-200) where the authentication provider API exposes session tokens. Specifically, during account enumeration, the token is leaked in the account identifier field without requiring explicit user consent. This allo...