CVE-2026-4364
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
IBM Verify Identity Access Container and IBM Security Verify Access Container versions 10.0 through 10.0.9.1 and 11.0 through 11.0.2 return certificate listings as a JSON payload but incorrectly set the Content-Type header to text/html. Browsers may interpret the JSON data as executable script, enabling JavaScript injection and potential cross-site scripting (XSS).
Risk Assessment
Potential cross-site scripting (XSS) attack in the user's browser, which could lead to session theft or unauthorized actions within the application context.
Recommendation
Update IBM Verify Identity Access and IBM Security Verify Access to fixed versions. Additionally, consider enforcing Content-Type: application/json for certificate listing responses and implementing XSS protections.
Other vulnerabilities in IBM Verify Identity Access
See all- CVE-2026-11928Critical
IBM Verify Identity Access is vulnerable to a buffer overflow attack.
- CVE-2026-11921Critical
IBM Verify Identity Access containers may not apply management password change operations correctly.
- CVE-2026-109126High
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.
- CVE-2026-12358High
IBM Verify Identity Access contains a vulnerability due to insufficient validation of incoming request resources. A remote attacker could cause a denial of service.
- CVE-2026-12101High
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
- CVE-2026-11934High
IBM Verify Identity Access contains a vulnerability due to improper validation of user-supplied input. An administrator could execute additional commands they are not entitled to.
- CVE-2026-11926High
IBM Verify Identity Access contains a vulnerability due to insufficient validation of incoming request resources. A remote attacker could cause a denial of service.
- CVE-2026-13277Medium
IBM Verify Identity Access allows a remote attacker to conduct phishing attacks via an open redirect. By luring a victim to a crafted website, the attacker can spoof the displayed URL and redirect the user to a malicious site that appears trusted.
- CVE-2026-13276Medium
This entry covers IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001, IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, and the corresponding container versions. The description does not include technical details of the vulnerability.
- CVE-2026-13272Medium
IBM Verify Identity Access is missing origin validation, allowing a remote attacker to perform operations as the victim and potentially launch further attacks against the systems.
Original NVD description (English source)
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 allows certificate listings retrieved via a browser session to return a JSON payload while incorrectly specifying the response Content-Type as text/html. Because the content is delivered with an HTML MIME type, browsers may interpret the JSON data as executable script under certain conditions. This creates an opportunity for JavaScript injection, potentially leading to cross-site scripting (XSS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS