CVE-2026-10545
published 2026-07-30CVE-2026-10545: IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites…
PriorityP342high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
EPSS
0.38%
31.2th percentile
IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | planning_analytics_local | 2.1.0 – 2.1.21 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Planning Analytics Local up to 2.1.21 redirect
vuldb·2026-07-30·CVSS 7.5
CVE-2026-10545 [HIGH] IBM Planning Analytics Local up to 2.1.21 redirect
A vulnerability labeled as problematic has been found in IBM Planning Analytics Local up to 2.1.21. This affects an unknown function. Executing a manipulation can lead to open redirect.
This vulnerability appears as CVE-2026-10545. The attack may be performed from remote. There is no available exploit.
GHSA
IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL.
ghsa_unreviewed·2026-07-30
CVE-2026-10545 [HIGH] CWE-601 IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL.
IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-30
Published