CVE-2025-36359 Overview
CVE-2025-36359 is a session management vulnerability in IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2. The applications fail to invalidate session identifiers after expiration. An authenticated user can reuse an expired session token to impersonate another user on the system. The flaw maps to [CWE-613: Insufficient Session Expiration].
The vulnerability requires low privileges and no user interaction. Attackers can exploit it remotely over the network. Successful exploitation compromises confidentiality and integrity of affected user sessions.
Critical Impact
An authenticated attacker who obtains an expired session identifier can impersonate other users, gaining unauthorized access to their data and privileges within IBM DevOps Automation and DevOps Loop.
Affected Products
- IBM DevOps Automation 1.0.1
- IBM DevOps Loop 1.0.2
Discovery Timeline
- 2026-06-30 - CVE-2025-36359 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2025-36359
Vulnerability Analysis
The vulnerability stems from insufficient session expiration handling in IBM DevOps Automation and IBM DevOps Loop. When a user session expires, the application does not invalidate the associated session identifier on the server side. The stale session ID remains accepted for authentication requests. This allows an authenticated attacker who has captured or retained an expired session token to continue using it against the application.
Session identifiers should be treated as short-lived credentials. Expired or logged-out sessions must be removed from the server session store immediately. IBM DevOps Automation 1.0.1 and DevOps Loop 1.0.2 retain these identifiers past their intended lifetime, breaking the trust boundary between authenticated states.
The issue is classified under [CWE-613] (Insufficient Session Expiration). The EPSS probability of 0.201% indicates a relatively low likelihood of active exploitation, but the impact on multi-tenant DevOps environments remains significant.
Root Cause
The application relies on client-side session lifetime controls without enforcing server-side invalidation. Session tokens that have exceeded their expiration window are still honored during authorization checks. The session store does not purge or blacklist tokens on logout or timeout.
Attack Vector
An authenticated attacker on the network obtains a session identifier from a previous session, either their own or another user's. The attacker submits the expired token in a request to the DevOps Automation or DevOps Loop application. Because the server does not verify freshness or invalidate the token, the request is processed under the associated user identity. The attacker gains access to resources, pipelines, or automation workflows belonging to the impersonated user.
Description of exploitation: The attack requires no user interaction and no elevated privileges beyond initial authentication. See the IBM Support Document for vendor technical details.
Detection Methods for CVE-2025-36359
Indicators of Compromise
- Reuse of session identifiers after logout events recorded in application logs
- Concurrent active sessions using the same session ID from different source IP addresses or user agents
- Authenticated requests occurring after documented session timeout windows
- Unexpected access to pipelines, projects, or automation resources by users outside their normal work patterns
Detection Strategies
- Correlate session ID usage against session expiration timestamps in application access logs
- Baseline user session durations and alert on sessions extending beyond configured timeout thresholds
- Monitor for the same session cookie appearing across geographically distant IP addresses within short intervals
- Review IBM DevOps Automation and DevOps Loop authentication audit trails for anomalous session reuse patterns
Monitoring Recommendations
- Enable verbose session lifecycle logging in IBM DevOps Automation and DevOps Loop
- Forward authentication and session events to a centralized SIEM for correlation
- Alert on privileged operations executed by sessions that should have expired
- Track session token issuance and invalidation events to identify gaps in server-side session cleanup
How to Mitigate CVE-2025-36359
Immediate Actions Required
- Apply IBM security updates for DevOps Automation and DevOps Loop as documented in the IBM Support Document
- Reduce configured session timeout values to limit the exposure window for stale tokens
- Force logout of all active sessions and require reauthentication after patching
- Rotate any long-lived API tokens or service credentials used within affected DevOps workflows
Patch Information
IBM has published remediation guidance in the vendor advisory. Consult the IBM Support Document for the specific fix packs and upgrade paths that address CVE-2025-36359 in IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2.
Workarounds
- Restrict network access to IBM DevOps Automation and DevOps Loop interfaces using firewall rules or VPN gating until the patch is applied
- Enforce shorter session lifetimes and require multi-factor authentication for privileged accounts
- Monitor and manually terminate suspicious sessions through administrative controls
- Rotate session signing keys where supported to invalidate previously issued tokens
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
