CVE-2026-10545
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
IBM Planning Analytics Local versions 2.1.0 through 2.1.21 are vulnerable to an open redirect. An attacker can redirect users to arbitrary external websites via a crafted URL. If used in SSO flows, this could expose session tokens and allow session hijacking.
Risk Assessment
Users may be unknowingly redirected to malicious sites, risking credential theft, session token exposure, and account takeover.
Recommendation
Upgrade IBM Planning Analytics Local to a version later than 2.1.21 that includes a fix for the open redirect vulnerability.
Other vulnerabilities in IBM Planning Analytics Local
See all- CVE-2025-36437Medium
IBM Planning Analytics Local 2.1.0 through 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.
- CVE-2025-36357High
IBM Planning Analytics Local versions 2.1.0 through 2.1.14 allow a remote authenticated user to traverse directories on the system. An attacker can send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files.
- CVE-2025-36299Medium
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code, which could be used in further attacks against the system.
Original NVD description (English source)
IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS