IBM Security Verify Access 10.0 through 10.0.9.2, IBM Verify Identity Access 11.0 through 11.0.3, and IBM Verify Identity Access Container 11.0 through 11.0.3 contain an authentication bypass vulnerability (CWE-302). An authenticated user can exploit this flaw by crafting a special request that allows privilege escalation to another user's privileges. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality and integrity, with network attack vector, low attack complexity, and no user interaction required. The vulnerability is published and assigned CVE-2026-13267 but currently lacks an official remediation or patch from IBM.

An authenticated attacker can bypass authentication controls to assume the privileges of another user, potentially gaining unauthorized access to sensitive information or performing actions with elevated privileges. The confidentiality and integrity impacts are high, while availability is not affected. This could lead to unauthorized data access or modification within the affected IBM Security Verify Access environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the affected systems to trusted users only and monitor for unusual privilege escalation activities. Follow IBM's official communications for updates on patches or workarounds.