Verify Identity Access CVE-2026-11904

No authentication is required - the CVSS vector (PR:N, UI:N, AV:N) confirms the vulnerability is exploitable by any remote, unauthenticated party with network access to the application's web interface. The vulnerability is triggered when the application encounters an error condition that causes it to return detailed technical information in the browser response; no special non-default configuration is documented as a prerequisite in the available data. Exploitation is constrained by the need for network-level reachability to the affected product's web interface - organizations that deploy these IAM appliances behind internal network boundaries or VPNs significantly reduce realistic attacker reach despite the zero-authentication requirement.

The CVSS 3.1 base score of 5.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N, UI:N) flaw with scoped, low confidentiality impact (C:L) and no integrity or availability effect. While the raw score appears moderate, the threat context warrants elevated concern for defenders: the product is an authentication gateway, meaning any reconnaissance data leaked - backend paths, component versions, internal error types - directly enables more surgical attacks against authentication bypass, privilege escalation, or session management flaws. No EPSS score was provided in the input data, preventing quantitative exploitation probability comparison. No CISA KEV listing and no public proof-of-concept code have been identified at time of analysis, which tempers urgency. However, the complete absence of an authentication barrier (PR:N, UI:N) means any internet-exposed deployment is immediately reachable. The real-world priority should be moderate-to-elevated for organizations that expose these IAM endpoints publicly, and lower for air-gapped or internally-only deployments.

An unauthenticated attacker sends malformed or boundary-case HTTP requests to a publicly accessible IBM Security Verify Access or Verify Identity Access endpoint - for example, crafting requests with unexpected parameters, oversized headers, or invalid authentication tokens - causing the application to raise an unhandled exception. The server returns a detailed technical error page in the browser containing stack traces, internal module names, path structures, or component version strings. The attacker records these details and uses them to fingerprint the exact software version, identify internal service architecture, and select targeted exploits for subsequent attacks. No public proof-of-concept is known at time of analysis.