IBM Verify Identity Access contains a CWE-601 URL Redirection to Untrusted Site ('Open Redirect') vulnerability identified as CVE-2026-13277. An attacker can exploit this by persuading users to visit specially crafted URLs that redirect them to malicious sites while displaying a trusted URL. This vulnerability affects versions 10.0.0 and 11.0.0 of the product. No CVSS score or detailed vendor advisory is provided, and no known exploits are reported in the wild.

Successful exploitation can enable phishing attacks by misleading users into visiting malicious websites that appear legitimate. This may result in disclosure of highly sensitive information or enable further attacks against the victim. There is no indication of direct system compromise or code execution from the provided data.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the IBM advisory for current remediation guidance. Until a fix is available, users should exercise caution with URLs and consider implementing URL validation or filtering controls to mitigate open redirect risks.