High priorityDisclosed

Advisory · CVE-2026-93892

IBM TRIRIGA exposes session tokens in HTML responses

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 exposes session tokens in HTML responses, letting an authenticated attacker obtain sensitive information. IBM rates it CVSS 3.1 8.1.

Advisory published October 13, 2026Independent summary
Vendor
IBM
Product
TRIRIGA Application Platform
Identifier / CWE
CVE-2026-93892
CWE-200
Action timing
Immediate
ELI5

Explain it like I’m five

TRIRIGA prints session tokens into its web pages, so anyone who can see the page source may be able to borrow someone else's session.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Sign in

    An attacker with a valid low-privilege TRIRIGA account browses the application.

  2. 02Token in page

    HTML responses contain session tokens that should not be exposed.

  3. 03Session abused

    The attacker uses exposed token material to obtain sensitive information or act within a session.

What happened

IBM disclosed CVE-2026-93892 for TRIRIGA Application Platform 5.0.0 through 5.0.8. Session tokens are exposed in the HTML response (CWE-200), and an authenticated remote attacker can use that exposure to obtain sensitive information.

No fixed version is named in the NVD record, so remediation follows the IBM bulletin rather than a version guess here.

What to do

  1. Inventory every TRIRIGA Application Platform deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to TRIRIGA Application Platform while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for sessions used from unusual locations and HTML responses or cached pages containing token material.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Patch, then force a session reset. Tokens already printed into pages or caches do not become safe just because the code is fixed.