An improperly neutralized piece of code in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 enables an attacker to read data that should remain confidential. The vulnerability is classified as CWE‑94, indicating that executing untrusted code could lead to leakage of sensitive information. The CVE description explicitly states an information disclosure attack, meaning the flaw can be exploited to obtain data beyond the intended access level.

Affected products are IBM Security Verify Access versions 10.0.0 through 10.0.9.2, including the container variant 10.0.0 through 10.0.9.2, and IBM Verify Identity Access versions 11.0.0 through 11.0.3, including the container variant 11.0.0 through 11.0.3. The vendor has issued patch releases: IBM Security Verify Access v10.0.9.3 and IBM Verify Identity Access v11.0.3.1, with matching container images for each product.

The CVSS score of 6.4 places this flaw in the medium severity band. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not been reported yet. The likely attack vector involves unauthenticated or low‑privilege HTTP/HTTPS requests to exposed application endpoints; an attacker would need to identify or guess the vulnerable API paths to retrieve privileged material. Detection and exploitation would be relatively straightforward for an attacker who can reach the affected services.