IBM Verify Identity Access Container and IBM Security Verify Access Container versions specified allow certificate listings to return JSON payloads with the response Content-Type incorrectly set as text/html. This improper MIME type specification can lead browsers to execute the JSON content as script, resulting in a cross-site scripting (CWE-79) vulnerability. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality and integrity but no impact on availability.

Successful exploitation could allow an attacker with low privileges and requiring user interaction to inject and execute arbitrary JavaScript in the context of the victim's browser session. This may lead to partial confidentiality and integrity compromise of data accessible in the browser session. There is no known exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious with certificate listing features and consider limiting access or applying compensating controls. Do not assume this vulnerability is mitigated without vendor confirmation.