CVE-2026-10545 IBM Planning Analytics Local is affected by Open Redirect
Attackers can redirect users to malicious sites via crafted URLs, potentially exposing session tokens and hijacking user accounts in SSO flows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-10545?
CVE-2026-10545 is a high-severity vulnerability in IBM Planning Analytics Local, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions.
Weakness: CWE-601
Which versions are affected by CVE-2026-10545?
It affects 1 product.
Products include Ibm Planning Analytics Local.
How do I fix CVE-2026-10545?
No fix has been published for CVE-2026-10545 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-10545 being exploited?
There is no known exploitation of CVE-2026-10545 in the wild and no public exploit code.
Other vulnerabilities in IBM Planning Analytics Local
- CVE-2025-36357 IBM Planning Analytics Local Directory Traversal
- CVE-2026-13365 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2024-35143 IBM Planning Analytics Local missing authentication
- CVE-2026-1267 IBM Planning Analytics Information Disclosure
- CVE-2025-33004 IBM Planning Analytics Local path traversal
Sources
Also known as GHSA-m58w-3wr6-xrfc.