CVE-2025-36057: IBM Cognos Analytics Mobile Auth Bypass

CVE-2025-36057 Overview

CVE-2025-36057 affects IBM Cognos Analytics Mobile for iOS versions 1.1.0 through 1.1.22. The application links against the Local Authentication Framework library even though it does not use biometric authentication. An attacker with physical access to an unlocked device can leverage this configuration to bypass authentication controls. IBM has published a security bulletin addressing the issue. The weakness is categorized as [CWE-299] Improper Check for Certificate Revocation, reflecting an improper trust check in the authentication flow.

Critical Impact
An attacker with physical device access can bypass application authentication and gain unauthorized access to Cognos Analytics data with high integrity impact.

Affected Products

IBM Cognos Analytics Mobile for iOS 1.1.0
IBM Cognos Analytics Mobile for iOS versions 1.1.1 through 1.1.21
IBM Cognos Analytics Mobile for iOS 1.1.22

Discovery Timeline

2025-07-21 - CVE-2025-36057 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36057

Vulnerability Analysis

The IBM Cognos Analytics Mobile iOS application includes the Local Authentication Framework library in its binary. This framework normally handles Touch ID and Face ID prompts on iOS devices. The Cognos Analytics Mobile application does not implement biometric authentication as a feature. The presence of an unused authentication library creates an attack surface that an adversary can manipulate to bypass application-level authentication checks. The result is unauthorized access to reports, dashboards, and analytics data protected behind the app's login flow.

Root Cause

The root cause is the inclusion of a Local Authentication Framework dependency that the application does not require. Because the biometric code path is never intended to succeed as a legitimate authentication mechanism, the app fails to validate the framework's return values in a security-relevant manner. This aligns with [CWE-299], where the software fails to properly verify the trust decision returned by a supporting library. The unused code path effectively becomes a bypass primitive.

Attack Vector

Exploitation requires physical access to a target iOS device that has the Cognos Analytics Mobile app installed. The attack complexity is low and requires no privileges or user interaction. An attacker can manipulate the local authentication response to trick the application into treating the session as authenticated. Successful exploitation compromises the integrity of authenticated actions performed within the app. Confidentiality and availability impacts are not directly implicated by the CVSS vector, but downstream data access is a realistic consequence.

No public proof-of-concept exploit code has been released for this vulnerability. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2025-36057

Indicators of Compromise

Unexpected launches or session activity in Cognos Analytics Mobile logs on managed iOS devices without a corresponding user login event.
Mobile Device Management (MDM) telemetry showing the Cognos Analytics Mobile app running versions 1.1.0 through 1.1.22 after a scheduled patch window.
Anomalous access patterns to Cognos Analytics backend services originating from previously idle mobile endpoints.

Detection Strategies

Inventory managed iOS devices with MDM to identify installations of Cognos Analytics Mobile within the vulnerable version range.
Correlate Cognos Analytics server-side authentication logs with expected mobile session events to spot sessions lacking proper authentication context.
Enable jailbreak and tampering detection through MDM policies to identify devices where local authentication manipulation is more feasible.

Monitoring Recommendations

Alert on Cognos Analytics API access from mobile clients that report app versions 1.1.0 through 1.1.22.
Monitor for repeated failed-then-successful authentication sequences from the same device identifier within short time windows.
Track physical loss or theft reports for corporate iOS devices with access to Cognos Analytics.

How to Mitigate CVE-2025-36057

Immediate Actions Required

Upgrade IBM Cognos Analytics Mobile for iOS to the fixed release listed in the vendor advisory.
Enforce device-level passcode and biometric lock policies through MDM for all users with the Cognos Analytics Mobile app installed.
Restrict the app's distribution to managed corporate devices and remove it from unmanaged personal devices with access to sensitive analytics.

Patch Information

IBM has published remediation guidance in the IBM Support Page for CVE-2025-36057. Administrators should follow the vendor bulletin to obtain the patched build of Cognos Analytics Mobile for iOS and deploy it through the App Store or enterprise MDM channels.

Workarounds

Revoke access tokens and force re-authentication for Cognos Analytics Mobile sessions until all devices are updated.
Require conditional access policies that block mobile client versions 1.1.0 through 1.1.22 from reaching Cognos Analytics backends.
Configure MDM remote wipe capabilities to reduce the window of exposure for lost or stolen devices.

bash

# Example MDM query to identify vulnerable Cognos Analytics Mobile installs
# Replace <mdm-cli> with your MDM vendor's command-line tool
<mdm-cli> devices list \
  --app-bundle-id com.ibm.ba.mobile.cognosanalytics \
  --app-version-range "1.1.0-1.1.22" \
  --output csv > vulnerable-cognos-mobile.csv