CVE-2026-13277: Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Security Verify Accessto a version that resolves this vulnerability.Fixed in 10.0.9.2 IF2 - Upgrade
Upgrade
IBM Verify Identity Accessto a version that resolves this vulnerability.Fixed in 11.0.3 IF2
Event History
Frequently Asked Questions
Who is most likely to be exposed to this issue?
Users who can be persuaded to visit an attacker-crafted website are exposed to phishing through a spoofed redirect that appears trusted. The described impact is theft of highly sensitive information or further attacks against the victim.
What does an attacker need to exploit it?
The attacker needs to persuade a victim to visit a specially crafted website. The issue is described as remotely exploitable through an open redirect.