CVE-2026-8640 in Security Verify Directory
Summary
by MITRE • 11/08/2026
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/08/2026
The vulnerability identified in IBM Security Verify Directory versions 10.0.0 through 10.0.4 and IBM Verify Directory version 11.0.0 stems from a misconfiguration in how session cookies are handled by the web server. Specifically, the application fails to set the SameSite attribute on its authentication session cookies. This missing configuration leaves the identity management platform susceptible to Cross-Site Request Forgery attacks, where an attacker can trick authenticated users into performing unintended actions without their knowledge or consent. The absence of this critical security header allows browsers to include these credentials in cross-origin requests, which violates modern browser security expectations for cookie handling.
From a technical perspective, the SameSite attribute is designed to prevent cookies from being sent with cross-site requests. When this attribute is omitted or set incorrectly, user agents such as web browsers will automatically attach session identifiers to HTTP requests initiated by third-party sites if those requests are triggered via methods like form submissions or image tags. In the context of IBM Verify Directory, which serves as a central point for authentication and identity verification, an attacker could craft malicious links or embed hidden forms on a different domain that targets the directory's administrative interfaces or user management endpoints. If a victim with an active session visits this malicious site, their browser may automatically send valid credentials along with the forged request to IBM Verify Directory.
The operational impact of this vulnerability is significant due to the sensitive nature of identity and access management systems. An attacker who successfully exploits this flaw could potentially perform actions on behalf of authenticated users or administrators. This might include modifying user attributes, resetting passwords, changing authentication policies, or even escalating privileges if administrative endpoints are accessible without additional multi-factor verification beyond the session cookie. Such unauthorized modifications can lead to a complete compromise of identity integrity, allowing attackers to establish persistent access, exfiltrate sensitive data associated with user accounts, or disrupt organizational operations by locking out legitimate users through malicious account changes.
This flaw aligns with Common Weakness Enumeration (CWE) category CWE-16, which covers Configuration issues that lead to security vulnerabilities, specifically relating to the improper configuration of web server settings for cookie security. Furthermore, in terms of attack tactics and techniques, this vulnerability facilitates actions described under MITRE ATT&CK technique T1556, which involves modifying authentication processes. By leveraging CSRF, an attacker bypasses traditional access controls that rely on session validity, effectively impersonating legitimate users to manipulate the identity management infrastructure.
To mitigate this risk, it is imperative for system administrators and developers to ensure that all cookies set by IBM Verify Directory include the SameSite attribute with a value of Strict or Lax. Setting it to Strict ensures that cookies are not sent with any cross-site requests, providing the highest level of protection against CSRF but potentially affecting some legitimate use cases involving redirects from external sites. The Lax setting offers a balanced approach by allowing cookies on top-level navigations while blocking them in sub-request contexts like images or frames. Additionally, organizations should implement additional layers of defense such as synchronizer tokens within forms and ensuring that state-changing operations require verification through non-cookie-based mechanisms where feasible. Regular security audits and configuration reviews against industry standards are recommended to prevent similar misconfigurations in identity management solutions.