EUVD-2026-57542
GHSA-46gh-hvgx-cq77
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Configuration-dependent exploitation warrants AC:H; PR:N because no credentials are needed to exploit the weakened cryptographic path; no availability impact is described or implied.
Primary rating from Vendor (us).
CVSS VectorVendor: us
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.
AnalysisAI
Authentication bypass in IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including container deployments) allows network-accessible unauthenticated attackers to circumvent the Reverse Proxy component's cryptographic validation of user-supplied data under certain configurations. The CVSS 7.4 (AV:N/AC:H/PR:N) rating reflects high confidentiality and integrity impact with no privilege requirement, though exploitation depends on specific deployment configurations being active. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the IBM Verify Access or IBM Verify Identity Access Reverse Proxy to be deployed in 'certain configurations' as stated by IBM - the exact configuration parameters are not disclosed in the public advisory, but the AC:H CVSS metric confirms that exploitation is not achievable against arbitrary or default deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.4 score combines network reachability (AV:N) with no privilege requirement (PR:N) and no user interaction (UI:N), which would normally indicate a highly exploitable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to a target IBM Verify Access Reverse Proxy endpoint, operating against a deployment in the specific vulnerable configuration, supplies crafted user-controlled data containing weakened or manipulated cryptographic material to the authentication validation path. The Reverse Proxy fails to reject the insufficient cryptographic proof, granting the attacker authenticated access to protected backend resources without valid credentials. … |
| Remediation | Consult the IBM Support advisory at https://www.ibm.com/support/pages/node/7283079 immediately for patched versions and configuration-specific remediation guidance, as exact fixed version numbers are not enumerated in the available public data - patch version confirmed available per vendor advisory but specific release identifier not independently verified. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Security Verify Access and IBM Verify Identity Access deployments to identify instances running versions 10.0-10.0.9.2 or 11.0-11.0.3, and enable enhanced monitoring and alerting on affected Reverse Proxy components. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitr
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauth
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today