Threats affecting pkg:maven/com.ibm/verify_identity_access

CVE-2026-11888 is a medium severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access. It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability involves improper control of code generation, classified as CWE-94, which can lead to information disclosure. The CVSS 3.1 base score is 6.4, indicating a moderate risk with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or remediation details are provided in the available data. There are no known exploits in the wild at this time.

CVE-2026-16823 is a critical improper authentication vulnerability in IBM Security Verify Access and IBM Verify Identity Access. Versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3 are affected. This flaw could allow a remote attacker to bypass security restrictions without authentication, potentially leading to full confidentiality and integrity compromise. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-16830 is an SQL injection vulnerability in IBM Security Verify Access and IBM Verify Identity Access versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. A remote authenticated attacker could exploit this flaw to modify data and cause a denial of service. The vulnerability has a medium severity with a CVSS score of 5.4.

IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3 contain a cross-site scripting (XSS) vulnerability. This flaw allows an unauthenticated attacker to inject arbitrary JavaScript into the web user interface, potentially altering functionality and leading to credential disclosure within a trusted session. The vulnerability has a high severity rating with a CVSS score of 8.2.

CVE-2026-18740 is a high-severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access that allows a remote authenticated attacker to perform unauthorized actions via argument injection. It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability stems from improper neutralization of argument delimiters in a command, classified as CWE-88.

CVE-2026-19491 is a critical improper authentication vulnerability in IBM Security Verify Access and IBM Verify Identity Access. Versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3 are affected. This flaw allows a remote attacker to bypass authentication without any privileges or user interaction. The vulnerability has a CVSS score of 9.1, indicating high impact on confidentiality and integrity. No patch information is provided in the available data.

CVE-2026-19482 is a high-severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. It allows a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments (CWE-88). The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.

IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3 contain a vulnerability where an authenticated user can cause a denial of service by exploiting improper allocation of system resources via a specially crafted HTTP query. This vulnerability does not impact confidentiality or integrity but can disrupt availability.

CVE-2026-78406 is a critical vulnerability in IBM Security Verify Access and IBM Verify Identity Access that allows remote unauthenticated attackers to execute arbitrary code via deserialization of untrusted data. It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges required, and no user interaction needed.

CVE-2026-19878 is a medium severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access that allows a remote authenticated attacker to bypass additional authentication workflow steps. This affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability relates to improper enforcement of behavioral workflow, potentially reducing the effectiveness of multi-step authentication processes.

IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3 contain a cross-site scripting (XSS) vulnerability. This flaw allows an authenticated user to inject arbitrary JavaScript code into the web user interface, potentially altering its intended functionality and leading to credential disclosure within a trusted session. The vulnerability has a medium severity rating with a CVSS score of 5.4.

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.