An admission control flaw in IBM Verify Identity Access and IBM Security Verify Access, both in appliance and container form, permits an attacker to send requests to internal authentication endpoints that are normally shielded by a reverse proxy. This flaw is a form of server‑side request forgery; by exploiting it an attacker can reach resources inside the protected network, potentially revealing or manipulating authentication data or other sensitive services. The impact is the ability to bypass an access control gateway and expose internal endpoints.

IBM Verify Identity Access versions 11.0 through 11.0.2 and IBM Security Verify Access versions 10.0 through 10.0.9.1, including their containerized equivalents. Updated appliance releases are 11.0.2 and 10.0.9.1, while the container images are provided via the IBM Verify documentation portal.

The CVSS base score of 7.2 indicates a moderate‑to‑high severity vulnerability, though the EPSS score of less than 1% suggests exploitation is currently uncommon. The flaw is not listed in the CISA KEV catalog, implying limited exploitation in the wild. An attacker would need network access to the affected systems and the ability to craft requests that target the reverse‑proxied internal endpoints; no additional pre‑authentication is mentioned, so the attack vector is inferred to be remote network access.