Cryptographic Validation Vulnerability in IBM Security Verify Access

IBM has disclosed a security vulnerability affecting IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3, including the containerized deployment). The issue resides within the Reverse Proxy component, which, under specific configurations, performs insufficient cryptographic validation of user-supplied data. This flaw may allow an attacker to bypass security controls by providing malformed or manipulated data that the proxy incorrectly authenticates or validates. The vulnerability is assigned CVE-2026-11923 and carries a CVSS base score of 7.4, indicating high severity due to the potential impact on authentication and session integrity. Defenders should prioritize auditing reverse proxy configurations and applying available patches provided by IBM to remediate the potential for session hijacking or unauthorized access.

Impact

Successful exploitation of this vulnerability can result in the bypass of security controls enforced by the IBM Reverse Proxy. This may allow unauthorized users to gain access to protected resources or manipulate authentication flows, potentially leading to unauthorized data access or session persistence by malicious actors within the enterprise environment.

Recommendation

• Apply the security patches for IBM Security Verify Access 10.0.x and IBM Verify Identity Access 11.0.x provided by IBM to resolve CVE-2026-11923.
• Audit Reverse Proxy configurations for high-risk deployment settings as specified in IBM security advisories.
• Monitor webserver and proxy logs for anomalous authentication attempts that bypass expected cryptographic signatures or identity assertions.