Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

Successful exploitation of CVE-2026-1343 allows an attacker to bypass the reverse proxy protecting IBM Verify Identity Access's internal authentication services. This direct access enables attackers to potentially craft malicious requests, impersonate legitimate users, and gain unauthorized access to sensitive data, including user credentials and session tokens. The blast radius extends to any system relying on IBM Verify Identity Access for authentication, potentially impacting a wide range of applications and services. While no direct data exfiltration is explicitly mentioned, the ability to authenticate as a user opens the door to further exploitation and data compromise.

Organizations heavily reliant on IBM Verify Identity Access for single sign-on (SSO) and multi-factor authentication (MFA) are at significant risk. Environments with weak network segmentation or inadequate WAF configurations are particularly vulnerable. Shared hosting environments utilizing IBM Verify Identity Access should be assessed for potential cross-tenant impact.

• ibm: Examine access logs for requests bypassing the reverse proxy, specifically targeting internal authentication endpoints. Look for unusual patterns or requests originating from unexpected sources. • generic web: Use curl to probe for direct access to internal authentication endpoints. For example, curl <internalauthendpoint>. • generic web: Review response headers for signs of internal server exposure, such as revealing internal IP addresses or server names.

1. 2026-04-08Disclosure

   disclosure

1. Reserviert2026-01-22
2. Veröffentlicht2026-04-08
3. EPSS aktualisiert2026-04-15

The primary mitigation for CVE-2026-1343 is to upgrade to a patched version of IBM Verify Identity Access as soon as it becomes available. Until the upgrade can be performed, implement temporary workarounds. A Web Application Firewall (WAF) can be configured to block direct access to internal authentication endpoints. Specifically, rules should be created to prevent requests bypassing the reverse proxy. Review and strengthen network segmentation to limit the potential impact of a successful attack. After upgrade, confirm functionality by attempting authentication through the standard access paths and verifying that internal endpoints are no longer directly accessible.