A remote authenticated attacker can obtain sensitive information because session tokens are included in the HTML response of the IBM TRIRIGA Application Platform. The flaw violates the confidentiality principle and is identified as CWE‑200. The attacker can use the leaked tokens to impersonate a session or gain further access to protected resources.

IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 are affected. The vulnerability exists in the Admin Console component of the platform.

The CVSS score of 8.1 indicates a high severity impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires authenticated access to the system, so only users with valid credentials can exploit the issue. Once authenticated, the attacker immediately receives a valid session token and can reuse it for unauthorized operations, potentially exposing business‑critical data.