CVE-2026-11904
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
IBM Verify Identity Access and Security Verify Access products may return detailed technical error messages in the browser, allowing a remote attacker to obtain sensitive information.
Risk Assessment
Disclosed information could be used in further attacks against the system, increasing the risk of security breaches.
Recommendation
Update to a version that eliminates information leakage in error messages and configure the server to not return detailed errors.
Other vulnerabilities in IBM Verify Identity Access
See all- CVE-2026-7364Low
IBM Verify Identity Access and IBM Security Verify Access contain an open redirect vulnerability that allows a remote attacker to conduct phishing attacks by using a specially crafted request to redirect a victim to arbitrary websites.
- CVE-2026-4938Medium
IBM Verify Identity Access and IBM Security Verify Access in the specified versions could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions.
Original NVD description (English source)
IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.