CVE-2026-13277

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-13277

Published

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-13277

Published

Verify Identity Access

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "IBM",
                    "product": "Verify Identity Access",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "11.0.0",
                            "lessThanOrEqual": "11.0.3 Interim Fix 001",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:verify_identity_access:11.0.3:interim_fix_001:*:*:*:*:*:*"
                    ]
                }

Security Verify Access

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "IBM",
                    "product": "Security Verify Access",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "10.0.0",
                            "lessThanOrEqual": "10.0.9.2 Interim Fix 001",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:security_verify_access:10.0.9.2:interim_fix_001:*:*:*:*:*:*"
                    ]
                }

Verify Identity Access Container

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "IBM",
                    "product": "Verify Identity Access Container",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "11.0.0",
                            "lessThanOrEqual": "11.0.3 Interim Fix 001",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:verify_identity_access_container:11.0.3:interim_fix_001:*:*:*:*:*:*"
                    ]
                }

Security Verify Access Container

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "IBM",
                    "product": "Security Verify Access Container",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "10.0.0",
                            "lessThanOrEqual": "10.0.9.2 Interim Fix 001",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:security_verify_access_container:10.0.9.2:interim_fix_001:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON