CVE-2026-1343 is a high-severity SSRF vulnerability (CWE-918) in IBM Verify Identity Access Container and IBM Security Verify Access Container products. It affects versions 11.0 through 11.0.2 for Verify Identity Access Container and 10.0 through 10.0.9.1 for Security Verify Access Container. The vulnerability enables an unauthenticated attacker to bypass the reverse proxy protections and contact internal authentication endpoints, potentially leading to limited confidentiality and integrity impacts. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and scope change. No patch or remediation guidance is currently provided by IBM, and no known exploitation has been reported.

An attacker exploiting this SSRF vulnerability can send unauthorized requests to internal authentication endpoints that are normally shielded by the reverse proxy. This could lead to limited confidentiality and integrity impacts, such as unauthorized information disclosure or manipulation of authentication processes. There is no indication of availability impact. The vulnerability does not require privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, organizations should monitor IBM's security advisories closely. Until a patch is available, consider restricting network access to internal authentication endpoints and applying additional network-level protections to limit SSRF attack vectors where feasible.