EUVD-2026-57546
GHSA-w466-hw2m-2ph2
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N) but limited to non-default 'certain configurations' (AC:H); weak crypto validation harms confidentiality and integrity, not availability (A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.
AnalysisAI
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the IBM Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) component to be running in one of the 'certain configurations' where cryptographic validation of user-supplied data is weakened - the CVE text does not name the exact setting, so the precise enabling configuration must be confirmed against IBM advisory node 7283079. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here conflict and should temper the raw score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach an internet-facing Verify Access Reverse Proxy running a vulnerable configuration submits crafted user-supplied data whose cryptographic protection the proxy fails to validate at the expected strength, causing the proxy to trust forged or tampered input and undermine an authentication or authorization decision. No public proof-of-concept is available, and the CVSS network vector with (as scored) low complexity means the network-facing step is straightforward, though the real-world requirement of a specific configuration raises the practical bar. |
| Remediation | Apply the IBM-provided fix per the vendor advisory at https://www.ibm.com/support/pages/node/7283079 (Patch available per vendor advisory; an exact fixed version is not stated in the available data, so confirm the target build against that IBM support note for both the appliance and Container editions). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running IBM Security Verify Access 10.0 through 10.0.9.2 or Verify Identity Access 11.0 through 11.0.3, and assess which deployments match the 'certain configurations' described in the vulnerability (contact IBM support or review advisory for configuration risk assessment). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitr
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauth
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
Same weakness CWE-310 – Cryptographic Issues
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today