An inconsistency in HTTP request parsing performed by a reverse proxy in IBM Verify Access and IBM Security Verify Access allows a remote attacker to access confidential identity and access data. This flaw, identified as a protocol implementation error (CWE-444), leads attackers to retrieve information that should be protected by the system's access controls. The vulnerability can compromise data confidentiality without granting system-level execution privileges.

The affected products are IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1, along with their containerized variants (Verify Identity Access Container 11.0.x and Security Verify Access Container 10.0.x).

The CVSS score of 5.3 indicates moderate severity, while an EPSS score below 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack likely involves crafting HTTP requests that exploit the reverse proxy’s misinterpretation, allowing the attacker to read protected data. Prompt patching mitigates the exposure risk.