IBM Verify Identity Access Container and IBM Security Verify Access Container versions 10.0 through 10.0.9.1 and 11.0 through 11.0.2 contain an open redirect vulnerability (CWE-601). An attacker can exploit this by sending a specially crafted request that causes the application to redirect a user to an arbitrary external website. This could be leveraged in phishing attacks to trick users into visiting malicious sites. The CVSS 3.1 base score is 3.1, indicating low severity, with network attack vector, high attack complexity, no privileges required, and user interaction needed. The vulnerability does not affect confidentiality or availability but has limited impact on integrity. There is no vendor-provided patch or advisory available at this time.

The vulnerability allows attackers to redirect users to arbitrary external websites, which could facilitate phishing attacks. There is no direct impact on confidentiality or availability, and the integrity impact is limited to the redirection behavior. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious of unexpected redirects and verify URLs before following links. No vendor advisory or patch links are currently provided.