EUVD-2026-45268
GHSA-r385-683v-qrc8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoint requires no authentication or interaction; impact is limited to partial confidentiality as only diagnostic metadata is disclosed, with no integrity or availability effect.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
AnalysisAI
IBM Security Verify exposes sensitive internal information to unauthenticated remote attackers through overly detailed technical error messages rendered in the browser. Affected deployments span four product variants - IBM Verify Identity Access, IBM Security Verify Access, and their respective container editions - all of which share the same CWE-209 root cause. No public exploit code or CISA KEV listing exists at time of analysis; the primary risk is reconnaissance enablement, where leaked error details lower the effort required for subsequent, more severe attacks.
Technical ContextAI
CWE-209 (Generation of Error Message Containing Sensitive Information) describes a class of vulnerabilities where applications return verbose diagnostic output - stack traces, internal paths, configuration values, software version strings, or database query fragments - directly to end-user browsers on error conditions. IBM Security Verify is an enterprise Identity and Access Management (IAM) platform. Four CPE-identified product lines are affected: cpe:2.3:a:ibm:verify_identity_access, cpe:2.3:a:ibm:security_verify_access, cpe:2.3:a:ibm:verify_identity_access_container, and cpe:2.3:a:ibm:security_verify_access_container, covering both traditional and containerized deployments. The vulnerability likely manifests in the web-facing authentication or administrative portal components where error handling is insufficiently sanitized before being returned to the client.
RemediationAI
Apply the vendor-released patch per the IBM security advisory at https://www.ibm.com/support/pages/node/7279510. The exact patched version number is not independently confirmed from available CPE data - consult the advisory directly for the target upgrade version. If immediate patching is not feasible, a compensating control is to configure network-layer access controls (WAF rules or firewall ACLs) to restrict access to IBM Security Verify administrative and authentication endpoints to trusted IP ranges only, reducing the pool of attackers who can trigger and observe error responses. Additionally, review and harden application-level error handling configurations to suppress verbose output in production environments if the platform exposes such settings. Note that network restriction does not eliminate the vulnerability for authorized but untrusted users already within the allowed IP range.
More in Verify Identity Access
View allFormat string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauth
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege
Local code execution in IBM Security Verify Access 10.0-10.0.9.1 and 11.0-11.0.2 (both container and non-container deplo
Local privilege escalation to root in IBM Verify/Security Verify Access products 10.0-11.0.2 allows unauthenticated loca
Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows r
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including
Privilege escalation via command injection in IBM Security Verify Access and IBM Verify Identity Access allows an authen
OS command injection in IBM Security Verify Access and IBM Verify Identity Access management interfaces enables already-
Server-Side Request Forgery (SSRF) in IBM Verify Identity Access and Security Verify Access products (versions 10.0-11.0
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) all
IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorre
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today