The flaw is a Time‑of‑Check to Time‑of‑Use weakness that causes authenticated user sessions to remain valid after a password change. Identified as CWE‑613, this defect allows an attacker who has legitimate access to continue using the same session and therefore impersonate the user or other system users without reauthentication. Consequently, confidential actions or data could be accessed by an individual who has not correctly logged in.

IBM Operations Analytics – Log Analysis, versions 1.3.5.0 through 1.3.8.4, inclusive of all intermediate releases.

The CVSS v3.1 score is 6.3, indicating a medium severity, while the EPSS score is below 1%, implying a low probability of widespread exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session and a password change event; the attacker must retain or steal the session token, after which the session will not be invalidated as it should be. While there is no remote code execution vector, the ability to impersonate a user after a password change poses a significant privilege escalation risk within the affected environment.