Executive brief
IBM Common Licensing Agent and ART (versions 9.0 and related patches) validate user input only on the client side, allowing attackers to send modified requests directly to the server that bypass these checks. An attacker could submit unauthorized or malicious values that cause unintended application behavior, potentially compromising the integrity of license management and reporting functions.
Technical details
This vulnerability is a classic client-side input validation bypass (CWE-20: Improper Input Validation). The application implements validation controls exclusively in client-side code (likely JavaScript), with no corresponding server-side validation to enforce the same restrictions. An attacker can intercept and modify HTTP requests before they reach the server, or craft requests directly using tools like curl or Burp Suite, to submit values that the client-side validator would reject. No authentication appears to be required (PR:N suggests public access to vulnerable endpoints). Successful exploitation allows an attacker to manipulate application state in unintended ways, potentially affecting license tracking, reporting accuracy, or system configuration. Patches are expected from IBM addressing server-side validation enforcement.
Affected products
- IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2
- IBM License Key Server Administration and Reporting Tool 9.0, 9.0.0.1, 9.0.0.2
Timeline
- 2026-09-14: disclosed: CVE-2026-19543 published