Skip to main content

Security Verify Access CVE-2026-13272

| EUVDEUVD-2026-78074
Missing Origin Validation in WebSockets (CWE-1385)
2026-09-14 ibm GHSA-7prr-jwvh-xvm3
Information Disclosure IBM Security Verify Access Verify Identity Access Container Security Verify Access Container Verify Identity Access

Lifecycle Timeline

1
CVE Published
Sep 14, 2026 - 20:13 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems.

Analysis

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Security Verify Access

View all
CVE-2024-35133 HIGH POC
8.2 Aug 29

IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
CVE-2024-28787 CRITICAL
10.0 Apr 04

IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
CVE-2024-49806 CRITICAL
9.8 Nov 29

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
CVE-2024-49805 CRITICAL
9.8 Nov 29

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
CVE-2020-4499 CRITICAL
9.8 Oct 15

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client

CVE-2024-49803 HIGH
8.8 Nov 29

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitr
CVE-2026-12004 HIGH
8.7 Aug 12

Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
CVE-2023-31003 HIGH
8.4 Jan 11

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V
CVE-2026-12359 HIGH
8.1 Aug 12

Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauth
CVE-2026-13267 HIGH
8.1 Aug 12

Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege

CVE-2024-31872 HIGH
8.1 Apr 10

IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle

CVE-2024-31871 HIGH
8.1 Apr 10

IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle

Same weakness CWE-1385 – Missing Origin Validation in WebSockets

View all
CVE-2025-24964 CRITICAL POC
9.6
CVE-2023-49805 HIGH POC
8.8
CVE-2025-54289 HIGH POC
8.1
CVE-2026-59804 HIGH POC
7.6
CVE-2025-68930 HIGH POC
7.1
CVE-2026-22689 MEDIUM POC
6.5
CVE-2024-23168 CRITICAL
9.8
CVE-2023-0957 CRITICAL
9.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-13272 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy