low · CVSS v3 3.4

CVE-2026-116376

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain an open redirect flaw that can be exploited by a remote authenticated user to facili

Overview

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain an open redirect flaw that can be exploited by a remote authenticated user to facilitate phishing attacks. The vulnerability allows attackers to redirect users to malicious sites after authentication, potentially compromising credentials or delivering malware. It is considered low severity but still relevant for environments that rely on this product.

Description

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability.

Impact

The flaw undermines the integrity of user navigation and can lead to credential theft or malware delivery, compromising confidentiality and availability of user data. Defenders must be aware that authenticated users could be tricked into visiting malicious URLs, potentially exposing sensitive information. The attack vector is limited to authenticated sessions, so only users with valid credentials are at risk.

Remediation

1. Apply the latest IBM Db2 Genius Hub patch or upgrade to a version that removes the open redirect flaw. 2. Configure the application to enforce a strict whitelist of allowed redirect URLs. 3. Monitor authentication and redirect logs for anomalous patterns. 4. Educate users about phishing risks and verify URLs before clicking.

Risk context

The CVSS v3 score of 3.4 indicates low severity, and no EPSS data is available. While the risk is modest, the potential for phishing makes it prudent to patch promptly and monitor for suspicious redirects.

Affected products

  • IBM Db2 Genius Hub 1.1.2
  • IBM Db2 Genius Hub 1.1.3
  • IBM Db2 Genius Hub 1.1.4
  • IBM Db2 Genius Hub 1.1.5

Scores

Severity
low
CVSS v2
2.7
CVSS v3
3.4
CVSS v4
—
EPSS
—

open-redirect phishing IBM Db2 authentication low-severity

← All CVEs

Related CVEs

low

CVE-2026-122301

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.

View analysis

low

CVE-2026-107776

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.

View analysis

low

CVE-2026-108838

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a local attacker to trigger uncontrolled resource consumption. This flaw can lead to a denial of service condition on the affected system.

View analysis

low

CVE-2026-121745

Node Version Manager (nvm) versions 0.40.0 through 0.40.8 expose authentication credentials in process arguments when downloading from private mirrors. This allows other local users on the same system to read the token via standard process inspection tools. The issue is resolved in version 0.41.0 by passing headers via stdin or private config files.

View analysis