CVE-2026-13272 identifies a missing origin validation vulnerability (CWE-1385) in the WebSocket feature of IBM Verify Identity Access. Without proper origin checks, an attacker can exploit this to impersonate a victim and execute unauthorized operations, which may lead to additional attacks on the system. The affected versions explicitly include 10.0.0 and 11.0.0. No CVSS score or vendor patch information is provided, and no known exploits are reported in the wild.

The vulnerability allows remote attackers to perform operations as the victim by exploiting the lack of origin validation in WebSockets. This could lead to unauthorized actions and potentially facilitate further attacks on the system. The exact impact depends on the operations accessible via the WebSocket interface in the affected product versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or workaround information is provided, users of IBM Verify Identity Access versions 10.0.0 and 11.0.0 should monitor IBM's official advisories for updates and consider restricting WebSocket access or implementing additional origin validation controls if possible.