CVE-2025-27909 is a medium severity (CVSS 5.4) cross-origin resource sharing flaw in IBM Concert Software 1.0.0 through 1.1.0. The domain names allowed to make cross-origin requests are not limited to trusted ones. IBM's bulletin names a fix: upgrade to IBM Concert Software 2.0.0.
What's affected
IBM lists IBM Concert Software 1.0.0 through 1.1.0 as affected. The bulletin says IBM strongly recommends upgrading to IBM Concert Software 2.0.0, available from the Container software library section of the IBM Entitled Registry, and follow the installation instructions for your type of deployment.
IBM lists no workarounds or mitigations for this issue. The same bulletin covers several other vulnerabilities fixed in 2.0.0, so the upgrade closes more than this one.
Severity in the record: medium, CVSS 5.4, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. Weakness classes: CWE-697 (Incorrect comparison), CWE-942 (Permissive cross-domain policy).
How to check if you're exposed
Check which version of Concert you run from the product's administration or about screen, or from the container image tag you deployed. Versions from 1.0.0 to 1.1.0 are in the affected range.
If you manage the deployment from a registry, list the image tag in use. For example, with a Kubernetes deployment you can read the running image:
kubectl get deploy -A -o wide | grep -i concert
Then test what your reverse proxy and the application return for the cross-origin headers. A permissive policy shows an Access-Control-Allow-Origin header that reflects arbitrary origins or uses a wildcard together with credentials. Read the bulletin before testing in production, and test only systems you own.
What to do now
- Plan the upgrade to IBM Concert Software 2.0.0 following IBM's installation instructions for your deployment type.
- Back up configuration and data before upgrading, and test the upgrade in a non-production copy.
- Until the upgrade, limit who can reach the Concert interface and review whether users browse it in the same browser sessions as untrusted sites.
- If you control a reverse proxy in front of the product, review its CORS and header handling.
- Read the other vulnerabilities in IBM's bulletin and confirm that they are covered by the same upgrade.
Why it matters
Cross-origin resource sharing (CORS) lets a server tell browsers which other websites may read its responses. When the allowed list is not limited to trusted domains, a page on an untrusted site can make requests to the application using the visitor's own logged in session and read the results. That is how the record describes the risk: an attacker can carry out privileged actions because the domain is not restricted.
The score is medium because it needs the victim to take part (UI:R) and the impact scores are low for confidentiality and integrity. The weakness is listed as CWE-942, a permissive cross-domain policy, with CWE-697 for incorrect comparison. It is a configuration style bug and the cleanest cure is an explicit allow list of origins.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Quick check
What does IBM say to do about CVE-2025-27909?
Upgrade to IBM Concert Software 2.0.0. The bulletin lists no workarounds or mitigations.
Does this need a user to do something?
Yes. The vector shows user interaction is required, for example a user visiting an attacker-controlled page while signed in to Concert.
Sources
Last reviewed: 19 October 2026.
