High · 8.1 CVE-2025-36359 EUVD-2025-210374GHSA-85r2-j732-h557

IBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.

Published Jun 30, 2026 · Updated Jul 1, 2026 · Assigned by ibm

Vendor: IBM Product: DevOps Automation Product: DevOps Loop

Description

IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.

Affected products

Vendor	Product	Affected	Fixed
IBM	DevOps Automation	1.0.1	—
IBM	DevOps Loop	1.0.2	—

References

https://www.ibm.com/support/pages/node/7277970 vendor-advisory patch