IBM’s reverse proxy, in certain configurations, performs weaker cryptographic validation of user‑supplied data. This weakness can allow an attacker to craft requests that bypass expected cryptographic checks, potentially enabling unauthorized access or privilege escalation. The flaw is catalogued as CWE‑287, which targets authentication mechanisms. Consequently, confidentiality and integrity of protected resources could be compromised if the vulnerability is successfully exploited.

Affected systems include IBM Verify Identity Access versions 11.0.0 through 11.0.3, IBM Verify Identity Access Container versions 11.0.0–11.0.3, IBM Security Verify Access versions 10.0.0–10.0.9.2, and IBM Security Verify Access Container versions 10.0.0–10.0.9.2. All installations using the reverse proxy feature in the specified configuration range are vulnerable.

The CVSS score of 7.4 indicates high severity, and although an EPSS score is not available and the vulnerability is not listed in the KEV catalog, the high score warrants concern. The attack vector is likely remote, via traffic routed through the reverse proxy. An attacker who can send crafted requests to the proxy could exploit the weakened cryptographic checks. No documented public exploit exists yet, but the theoretical risk remains significant.