IBM Bob version 2.0.3 contains a vulnerability where unauthorized browser extensions can retrieve session tokens through the authentication provider API. The session token is exposed in the account identifier field during account enumeration without requiring explicit user consent. This exposure could allow malicious extensions to access sensitive session information. The vulnerability has a low CVSS score of 3.3, indicating limited impact. No patch or remediation information is currently available.