CVE-2026-11923: CWE-287 Improper Authentication in IBM Security Verify Access
CVE-2026-11923 is a high severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access products. It affects versions 10.0 through 10.0.9.2 of Security Verify Access, and versions 11.0 through 11.0.3 of Verify Identity Access and its Container Reverse Proxy. The issue involves weaker than expected cryptographic validation of user-supplied data in certain configurations, leading to improper authentication (CWE-287). This could allow attackers to bypass authentication mechanisms under specific conditions.
AI Analysis
Technical Summary
IBM Security Verify Access versions 10.0 through 10.0.9.2, IBM Verify Identity Access versions 11.0 through 11.0.3, and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations have a vulnerability where cryptographic validation of user-supplied data is weaker than expected. This improper authentication issue (CWE-287) can potentially allow unauthorized access by bypassing authentication controls. The CVSS v3.1 score is 7.4 (high), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.
Potential Impact
Successful exploitation could lead to unauthorized access due to improper authentication validation, compromising confidentiality and integrity of the affected systems. There is no known exploitation in the wild at this time. The vulnerability does not impact availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented in the provided information. Users should monitor IBM advisories for updates and apply patches or configuration changes as recommended once available.
CVE-2026-11923: CWE-287 Improper Authentication in IBM Security Verify Access
Description
CVE-2026-11923 is a high severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access products. It affects versions 10.0 through 10.0.9.2 of Security Verify Access, and versions 11.0 through 11.0.3 of Verify Identity Access and its Container Reverse Proxy. The issue involves weaker than expected cryptographic validation of user-supplied data in certain configurations, leading to improper authentication (CWE-287). This could allow attackers to bypass authentication mechanisms under specific conditions.
CVSS v3.1
Score 7.4high
Affected software
cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
IBM Security Verify Access versions 10.0 through 10.0.9.2, IBM Verify Identity Access versions 11.0 through 11.0.3, and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations have a vulnerability where cryptographic validation of user-supplied data is weaker than expected. This improper authentication issue (CWE-287) can potentially allow unauthorized access by bypassing authentication controls. The CVSS v3.1 score is 7.4 (high), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.
Potential Impact
Successful exploitation could lead to unauthorized access due to improper authentication validation, compromising confidentiality and integrity of the affected systems. There is no known exploitation in the wild at this time. The vulnerability does not impact availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented in the provided information. Users should monitor IBM advisories for updates and apply patches or configuration changes as recommended once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ibm
- Date Reserved
- 2026-06-10T17:48:12.614Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7cd705bf8831d5391e9fef
Added to database: 08/12/2026, 20:26:45 UTC
Last enriched: 08/12/2026, 20:41:52 UTC
Last updated: 08/12/2026, 20:41:52 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.