IBM Verify Identity Access versions 11.0 through 11.0.2 and IBM Security Verify Access versions 10.0 through 10.0.9.1 contain an open redirect vulnerability (CWE-601). This flaw allows attackers to create specially crafted requests that redirect victims to untrusted external websites. The vulnerability could be leveraged in phishing campaigns to deceive users. The CVSS 3.1 base score is 3.1, reflecting a low severity with network attack vector, high attack complexity, no privileges required, user interaction required, and limited confidentiality impact. No vendor advisory or patch information is currently available, and the vulnerability is not related to cloud services.

The vulnerability enables attackers to redirect users to arbitrary external websites via crafted URLs, which can facilitate phishing attacks. There is no direct impact on confidentiality, integrity, or availability of the affected products. The overall severity is low due to the requirement for user interaction and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious of suspicious URLs that appear to originate from IBM Verify Identity Access or IBM Security Verify Access. No official mitigation or workaround has been provided by IBM at this time.