CVE-2025-36249: IBM Jazz Service Management Auth Bypass

CVE-2025-36249 Overview

CVE-2025-36249 affects IBM Jazz for Service Management versions 1.1.3.0 through 1.1.3.25. The application fails to set the Secure attribute on authorization tokens and session cookies. Browsers transmit these cookies over unencrypted HTTP connections whenever a user follows an http:// link tied to the application domain. Attackers positioned on the network path can capture the cookie values from cleartext traffic and reuse them to hijack authenticated sessions.

The issue is tracked as CWE-614: Sensitive Cookie in HTTPS Session Without Secure Attribute.

Critical Impact
Network-adjacent attackers can steal session cookies transmitted over cleartext HTTP and hijack authenticated Jazz for Service Management sessions.

Affected Products

IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25
Deployments exposing the Jazz web console over mixed HTTP/HTTPS environments
Integrations reusing Jazz session cookies for federated components

Discovery Timeline

2025-10-31 - CVE-2025-36249 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36249

Vulnerability Analysis

IBM Jazz for Service Management issues Set-Cookie headers for authorization tokens and session identifiers without the Secure cookie attribute. The Secure flag instructs the browser to transmit the cookie only over TLS-encrypted channels. Without it, the browser attaches the cookie to any request that matches the cookie scope, including plain HTTP requests.

An attacker who can observe network traffic on the same segment, an untrusted Wi-Fi network, or an upstream router can capture these cookies in cleartext. Reusing the captured cookie grants the attacker the victim's authenticated session state until the token expires or is invalidated.

Root Cause

The root cause is missing configuration of the Secure flag on cookies issued by the Jazz for Service Management authentication and session management layer. The application relies on transport confidentiality but does not enforce it at the cookie policy level, leaving downgrade and mixed-content scenarios exploitable.

Attack Vector

Exploitation requires the attacker to induce or observe an HTTP request from the victim's browser to a host in the cookie's scope. Attack paths include phishing links using http:// URLs, embedded HTTP resources on third-party sites, HTTP redirects, and captive portal manipulation. Once the browser sends the cookie in cleartext, any on-path adversary reads the value from the wire.

No verified public exploit code is available. See the IBM Support Page for vendor-specific technical details.

Detection Methods for CVE-2025-36249

Indicators of Compromise

Authenticated Jazz for Service Management sessions originating from IP addresses that differ from the initial login source within a short time window.
HTTP (port 80) requests to Jazz for Service Management hostnames carrying JSESSIONID, LtpaToken, or LtpaToken2 cookies in cleartext.
Repeated session cookie reuse across geographically inconsistent user agents.

Detection Strategies

Inspect Set-Cookie response headers from Jazz for Service Management and alert on cookies issued without the Secure attribute.
Correlate web proxy and firewall logs for outbound HTTP requests to Jazz hostnames that should only be reachable over HTTPS.
Monitor authentication logs for concurrent sessions sharing the same session identifier across distinct source addresses.

Monitoring Recommendations

Enable full request and response header logging on the reverse proxy fronting Jazz for Service Management.
Alert when a Jazz session cookie is observed on TCP port 80 in packet capture or NDR telemetry.
Track session lifetime and invalidate sessions that exceed expected idle thresholds.

How to Mitigate CVE-2025-36249

Immediate Actions Required

Apply the IBM-supplied fix referenced in the IBM Support advisory.
Force HTTPS on all Jazz for Service Management endpoints and disable HTTP listeners.
Invalidate active sessions after patching so users re-authenticate and receive cookies with the Secure flag set.

Patch Information

IBM has published remediation guidance in the vendor advisory at IBM Support node 7249820. Upgrade Jazz for Service Management to a fixed release above 1.1.3.25 as directed by IBM. After patching, confirm that all authentication and session cookies are issued with both Secure and HttpOnly attributes.

Workarounds

Configure the reverse proxy or WebSphere Liberty front end to rewrite Set-Cookie headers and append the Secure attribute.
Enforce HTTP Strict Transport Security (HSTS) with includeSubDomains on the Jazz hostname to prevent HTTP downgrade.
Restrict Jazz for Service Management access to VPN or internal network segments to reduce on-path attacker exposure.

bash

# Example: append Secure attribute via Apache reverse proxy
Header edit Set-Cookie ^(.*)$ $1;Secure;HttpOnly

# Example: enforce HSTS
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"