CVE-2026-13277
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
IBM Verify Identity Access allows a remote attacker to conduct phishing attacks via an open redirect. By luring a victim to a crafted website, the attacker can spoof the displayed URL and redirect the user to a malicious site that appears trusted.
Risk Assessment
The attacker can steal credentials or other sensitive information and use the victim to launch further attacks within the organization.
Recommendation
Update IBM Verify Identity Access to a patched version and implement filtering and validation of redirect URLs on the application side.
Other vulnerabilities in IBM Verify Identity Access
See all- CVE-2026-11928Critical
IBM Verify Identity Access is vulnerable to a buffer overflow attack.
- CVE-2026-11921Critical
IBM Verify Identity Access containers may not apply management password change operations correctly.
- CVE-2026-12358High
IBM Verify Identity Access contains a vulnerability due to insufficient validation of incoming request resources. A remote attacker could cause a denial of service.
- CVE-2026-12101Low risk· EPSS 4%
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
- CVE-2026-11934High
IBM Verify Identity Access contains a vulnerability due to improper validation of user-supplied input. An administrator could execute additional commands they are not entitled to.
- CVE-2026-11926High
IBM Verify Identity Access contains a vulnerability due to insufficient validation of incoming request resources. A remote attacker could cause a denial of service.
- CVE-2026-13276Medium
This entry covers IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001, IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, and the corresponding container versions. The description does not include technical details of the vulnerability.
- CVE-2026-13272Low risk· EPSS 4%
IBM Verify Identity Access is missing origin validation, allowing a remote attacker to perform operations as the victim and potentially launch further attacks against the systems.
- CVE-2026-13260High
IBM Verify Identity Access allows a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. The flaw affects how the product processes requests.
- CVE-2026-13297High
IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack.
Original NVD description (English source)
IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.