IBM Verify Identity Access versions 11.0 through 11.0.2 and IBM Security Verify Access versions 10.0 through 10.0.9.1 contain an open redirect vulnerability (CWE-601). This flaw allows remote attackers to redirect victims to arbitrary external websites via specially crafted requests. The vulnerability could be leveraged in phishing attacks by misleading users to malicious sites. The CVSS 3.1 base score is 3.1, reflecting low severity with network attack vector, high attack complexity, no privileges required, user interaction required, and limited confidentiality impact. No vendor remediation level or patch information is currently available.

The vulnerability enables attackers to redirect users to arbitrary websites, which can facilitate phishing attacks by tricking users into visiting malicious sites. The confidentiality, integrity, and availability impacts are minimal or none. The overall severity is low, and no known exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious of suspicious URLs involving IBM Verify Identity Access and related products. No vendor-provided mitigation or temporary fix is currently documented.