IBM Verify Identity Access contains an authentication bypass vulnerability identified as CVE-2026-12101. The flaw arises from improper validation of user-supplied requests, enabling an administrator to execute additional commands they are not entitled to. This is classified under CWE-289 (Authentication Bypass by Alternate Name). The affected versions explicitly include 10.0.0 and 11.0.0. No CVSS score or detailed vendor advisory is available, and no known exploits are reported in the wild.

An attacker with administrator privileges could exploit this vulnerability to perform unauthorized commands beyond their intended scope, potentially leading to privilege escalation within the IBM Verify Identity Access environment. The impact is limited to administrative users but could compromise system integrity or security controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or workaround is provided by IBM, restrict administrative access and monitor for unusual command executions. Do not assume the vulnerability is mitigated without vendor confirmation.