IBM Cognos Analytics Mobile (iOS) authentication bypass (IBM Cognos Analytics Mobile)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.21 % · percentile 11 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- ibm
- NVD status
- Analyzed
Description
IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 is vulnerable to authentication bypass by using the Local Authentication Framework library which is not needed as biometric authentication is not used in the application.
Weaknesses (CWE)
- CWE-299 — Improper Check for Certificate Revocation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.2 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N | ibm |
| CVSS 3.1 | MEDIUM 5.2 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N | NVD · psirt@us.ibm.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.6 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-22134
- GCVE · GCVE-0-2025-36057
Affected configurations (NVD CPE)
cpe:2.3:a:ibm:cognos_analytics_mobile:*:*:*:*:*:iphone_os:*:*≥ 1.1.0 < 1.1.23
Affected products
| Product | Versions |
|---|---|
| IBM · Cognos Analytics Mobile | affected 1.1.0 ≤ 1.1.22 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |