This vulnerability, identified as CWE-74, involves improper neutralization of special elements in output used by a downstream component within IBM Verify Identity Access reverse proxy. Specifically, it may allow an attacker to inject parameters into requests forwarded to third-party services, potentially causing unexpected or malicious behavior in those services. The vulnerability affects versions 10.0.0 and 11.0.0 of the product. There is no CVSS score or detailed vendor advisory information provided, and no known exploits in the wild have been reported.

The impact is that an attacker could manipulate requests sent through the IBM Verify Identity Access reverse proxy to third-party services by injecting parameters. This could result in unintended actions or security issues in those downstream services. However, no specific exploitation details or impact severity metrics are available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is announced by IBM, users should monitor vendor communications and apply any recommended updates or workarounds promptly.