CVE-2025-36359 is a vulnerability in IBM DevOps Automation 1.0.1 where session IDs remain valid after their expiration time. This insufficient session expiration issue (CWE-613) can enable an authenticated user to reuse expired session tokens to impersonate other users, potentially leading to unauthorized access. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality and integrity with network attack vector, low attack complexity, and no user interaction required. No official fix or patch has been announced by IBM as of the publication date.

An attacker with authenticated access could exploit the failure to invalidate expired session IDs to impersonate other users, compromising confidentiality and integrity of user sessions. This could lead to unauthorized actions performed under another user's identity. Availability impact is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing additional session management controls such as reducing session timeout durations and monitoring for suspicious session reuse. Avoid relying solely on session expiration for security.