Verify Identity Access CVE-2026-13272

Exploitation requires the victim to be an authenticated IBM Verify Identity Access (or Security Verify Access / container) user with an active session who is tricked into visiting attacker-controlled web content (UI:R). The attacker is unauthenticated (PR:N) and remote (AV:N) but cannot act without the victim's live session and interaction. Because the flaw is missing origin validation (CWE-1385), the affected functionality must be reachable via cross-origin requests (e.g., a WebSocket or state-changing endpoint that trusts the request origin). Impact is limited to Low confidentiality and Low integrity within the victim's privilege scope; no availability impact. Affected: Verify Identity Access ≤11.0.3 IF001, Security Verify Access ≤10.0.9.2 IF001, and their container editions.

This is a moderate-severity, likely low-priority issue in real-world terms. The vendor CVSS of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) reflects a network-reachable but user-interaction-dependent flaw with only Low confidentiality and integrity impact and no availability impact. CWE-1385 (Missing Origin Validation, typically WebSocket/cross-origin) combined with UI:R strongly indicates a cross-site request forgery / cross-site WebSocket hijacking class issue rather than a direct server compromise - the attacker rides an authenticated victim's session. Corroborating signals point to low urgency: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified. A vendor patch is available (IBM support node 7286188), which is the primary actionable signal. Net: this is a legitimate defense-in-depth fix to schedule during normal patch cycles, not an emergency - the PR:N rating is offset by the mandatory victim interaction and the need for the victim to hold a valid session, which sharply narrows practical exploitation.

An attacker crafts a malicious web page and lures an authenticated IBM Verify Identity Access user into visiting it while their session is active. Because the application fails to validate the request origin, the page issues cross-origin requests (e.g., a forged WebSocket or state-changing call) that execute operations in the victim's authenticated context. No public exploit code was identified at time of analysis, and success depends on the victim being logged in and interacting with attacker-controlled content.