IBM Verify Identity Access CVE-2026-7364

The victim must click a specially crafted URL that references the legitimate IBM Verify Identity Access or Security Verify Access host but contains a malicious redirect destination parameter - user interaction is mandatory (UI:R in CVSS). The attacker requires no authentication or privileges against the target system (PR:N). High attack complexity (AC:H) indicates the attacker must overcome redirect validation present in the application, such as parameter encoding, token binding, or referrer checks, beyond trivial parameter substitution. Exploitation is structurally limited to phishing scenarios and does not enable server-side code execution, data access, or privilege escalation. No non-default server configuration is required - the redirect handling is inherent to the IAM platform's authentication flow. The attack is further constrained by the need to successfully deliver the crafted URL and have the victim engage with it.

The CVSS 3.1 base score of 3.1 (Low) accurately reflects constrained direct system impact: AC:H signals that exploitation requires overcoming redirect validation mechanisms beyond a simple parameter substitution, and UI:R confirms that a victim must actively engage with the crafted link. The only CIA impact is C:L - representing potential credential exposure via phishing rather than direct data exfiltration from the vulnerable system itself. No EPSS score was provided; KEV status is absent, and no POC has been identified, meaning this is a theoretical risk at present. Despite the low numerical score, the product context elevates realistic phishing risk: users interacting with an organization's IAM portal are conditioned to trust redirect flows from that domain and are less likely to scrutinize destination URLs, making this a higher-value phishing vector than a generic open redirect on a non-identity-critical application. This vulnerability does not enable direct system compromise, privilege escalation, or data exfiltration from the server - the risk is exclusively social-engineering enablement. Priority should be moderate for organizations with high-value user populations (executives, IT admins) who are frequent targets of credential phishing.

An attacker sends a phishing email to employees of an organization running IBM Verify Identity Access, embedding a link to the organization's legitimate IAM login page with a manipulated redirect parameter pointing to an attacker-controlled credential-harvesting site. The employee, recognizing the organization's own SSO domain in the URL, clicks the link and completes any authentication step, after which the application silently redirects them to the phishing site - which mimics the corporate intranet - where credentials are captured. No public exploit code exists for this vulnerability at time of analysis, and the AC:H rating suggests exploitation requires crafting requests that bypass any existing redirect validation logic present in the application.