The vulnerability arises from IBM Maximo Application Suite failing to mark authentication tokens and session cookies with the secure flag, enabling them to be transmitted over non‑HTTPS connections. Attackers can trigger the cookie to be sent to an insecure http:// URL by embedding the link in a phishing page or a site the user visits. When transmitted insecurely, the cookie values can be captured by an attacker through traffic sniffing, allowing session hijacking and unauthorized access to the system.

IBM Maximo Application Suite versions 9.1.x up to 9.1.8, 9.0.x up to 9.0.19, 8.11.x up to 8.11.30, and 8.10.x up to 8.10.33 are affected.

The CVSS score is 4.3, indicating moderate risk, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation is achievable remotely via a web link, requiring an attacker to supply an http:// URL that a user visits, making the risk dependent on user interaction with potential phishing or compromised sites.