IBM Verify Identity Access Container and IBM Security Verify Access Container versions 11.0 through 11.0.2 and 10.0 through 10.0.9.1 respectively contain an improper authentication vulnerability (CWE-287). Under specific load conditions, an attacker could bypass authentication controls to gain unauthorized access to the application. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability. No patch or fix information is currently available, and no exploits have been reported in the wild. The vulnerability is limited to the specified versions and does not affect cloud-hosted services.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authentication mechanisms and gain unauthorized access to the affected IBM Verify Identity Access Container or IBM Security Verify Access Container applications. This could lead to full compromise of the application, impacting confidentiality, integrity, and availability of the system. There are no reports of active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider limiting exposure of affected versions to untrusted networks and monitor for unusual authentication bypass attempts. Do not assume the vulnerability is mitigated without vendor confirmation.