Executive brief
IBM Security Verify Identity Access Reverse Proxy, a core component for managing identity and access control, may use weaker-than-expected cryptographic validation in certain configurations. An attacker could exploit this weakness to bypass security controls or forge authentication credentials, potentially compromising the integrity of identity verification processes and gaining unauthorized access to protected resources.
Technical details
This vulnerability involves improper cryptographic validation of user-supplied data within IBM Security Verify Identity Access Reverse Proxy when deployed in specific configurations. The weakness affects the validation mechanisms used to authenticate and verify requests, potentially allowing an attacker to bypass cryptographic protections through manipulation of submitted data. The vulnerability is reachable over the network without authentication requirements. Successful exploitation could lead to authentication bypass or credential forgery, depending on the specific configuration and deployment. IBM has issued security updates to address this issue.
Affected products
- IBM Security Verify Identity Access
Timeline
- 2026-09-15: disclosed