This vulnerability (CWE-918) in IBM Verify Identity Access Container and IBM Security Verify Access Container allows unauthenticated attackers to perform SSRF attacks by contacting internal authentication endpoints protected by the Reverse Proxy. The flaw affects multiple versions of the product line, specifically 11.0 through 11.0.2 for Verify Identity Access Container and 10.0 through 10.0.9.1 for Security Verify Access Container. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and partial confidentiality and integrity impacts.

An attacker exploiting this SSRF vulnerability can send crafted requests to internal authentication endpoints that should be inaccessible externally due to Reverse Proxy protections. This could lead to partial disclosure and modification of sensitive information within the authentication system. There is no indication of availability impact. No known exploits have been reported, and the vulnerability is rated high severity based on CVSS 3.1 metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting external access to the affected components and monitor for unusual internal request patterns. Avoid exposing internal authentication endpoints externally. Follow IBM's official communications for updates on patches or mitigations.