This vulnerability involves inconsistent parsing of HTTP requests between a reverse proxy and IBM Verify Identity Access Container or IBM Security Verify Access Container. Such discrepancies can be exploited by a remote attacker to smuggle HTTP requests, potentially leading to unauthorized access to sensitive information. The affected versions include IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

An attacker exploiting this vulnerability could gain unauthorized access to sensitive information due to the inconsistent HTTP request interpretation by the reverse proxy. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, monitor IBM's security advisories for updates. In the meantime, consider reviewing reverse proxy configurations and applying any recommended temporary mitigations from IBM if available.