CVE-2026-4820 identifies a vulnerability in IBM Maximo Application Suite (versions 8.10 through 9.1) where session cookies and authorization tokens lack the 'secure' attribute. Without this attribute, cookies can be transmitted over unencrypted HTTP connections if a user accesses an HTTP link, enabling attackers to capture these cookies by monitoring network traffic. This vulnerability is categorized under CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute) and impacts confidentiality by potentially exposing session tokens. The CVSS 3.1 base score is 4.3, indicating medium severity. No patch or remediation details are currently available, and no exploits have been reported.

The vulnerability may allow attackers to obtain session cookies or authorization tokens by tricking users into accessing HTTP links, leading to potential exposure of sensitive cookie data. This could compromise session confidentiality but does not directly affect integrity or availability. The impact is limited to the exposure of cookie values over insecure channels.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid accessing IBM Maximo Application Suite over unsecured HTTP links and ensure that all connections use HTTPS. Additionally, administrators should monitor for updates from IBM regarding this vulnerability.