IBM Verify Identity Access Container up to 11.0.2 Request redirect

Summaryinfo

A vulnerability, which was classified as problematic, has been found in IBM Verify Identity Access Container, Security Verify Access Container, Verify Identity Access and Security Verify Access up to 11.0.2. The affected element is an unknown function of the component Request Handler. Performing a manipulation results in redirect. This vulnerability is cataloged as CVE-2026-2475. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in IBM Verify Identity Access Container, Security Verify Access Container, Verify Identity Access and Security Verify Access up to 11.0.2. This affects an unknown functionality of the component Request Handler. The manipulation with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on integrity. The summary by CVE is:

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit this vulnerability using a specially crafted request to redirect a victim to arbitrary Web sites.

The advisory is shared at ibm.com. This vulnerability is uniquely identified as CVE-2026-2475 since 02/13/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/02/2026). MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Virtualization Software

Vendor

• IBM

Name

• Security Verify Access
• Security Verify Access Container
• Verify Identity Access
• Verify Identity Access Container

Version

• 11.0.0
• 11.0.1
• 11.0.2

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion