EUVD-2026-45291
GHSA-345w-9gm9-3223
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible redirect requires no attacker authentication but demands victim interaction and complexity to bypass validation; only confidentiality impact via phishing credential exposure applies.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionNVD
IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit this vulnerability using a specially crafted request to redirect a victim to arbitrary Web sites.
AnalysisAI
Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attackers to craft malicious URLs that redirect victims to arbitrary attacker-controlled websites, enabling phishing campaigns that exploit the trusted reputation of enterprise IAM infrastructure. Affected deployments span both on-premises and containerized editions across IBM Verify Identity Access 11.0-11.0.2 and IBM Security Verify Access 10.0-10.0.9.1. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7279510.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site / Open Redirect) describes the root cause: the application accepts a user-controlled redirect destination parameter without sufficiently validating that the target URL belongs to a trusted domain. IBM Verify Identity Access and IBM Security Verify Access are enterprise Identity and Access Management (IAM) platforms handling single sign-on, multi-factor authentication, and authorization for large organizations. Post-authentication redirect flows are a core feature of IAM systems, making redirect parameters an inherent and frequent attack surface in this product class. CPE data confirms four distinct product lines are affected: cpe:2.3:a:ibm:verify_identity_access, cpe:2.3:a:ibm:security_verify_access, cpe:2.3:a:ibm:verify_identity_access_container, and cpe:2.3:a:ibm:security_verify_access_container - covering both legacy and current branding as well as Kubernetes/container-native deployments.
RemediationAI
Apply the patch documented in IBM Security Advisory at https://www.ibm.com/support/pages/node/7279510; exact fixed version numbers are not independently confirmed from the available data and must be obtained directly from the advisory. Where immediate patching is not feasible, deploy a reverse proxy or WAF rule that validates the 'redirect_uri' or equivalent redirect parameter against a strict allowlist of approved internal domains, rejecting any request whose redirect target does not match - this blocks the attack vector but requires enumeration of all legitimate redirect destinations to avoid disrupting SSO flows. As an additional compensating control, consider enabling strict redirect URI validation within the IBM Verify product's own configuration if supported, which would enforce server-side allowlisting without external infrastructure changes. User awareness training targeted at recognizing unexpected redirect destinations after IAM login can reduce the effectiveness of phishing attempts that do reach victims.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today