The flaw is an improper authentication weakness that permits a remote attacker to bypass security controls. Based on the description, it is inferred that an attacker could obtain authentication credentials or gain access as a legitimate user, allowing them to acquire confidential data or perform unauthorized actions. This compromise violates confidentiality, integrity, and could affect availability if the attacker manipulates system functions. The vulnerability is classified as CWE‑287.

IBM Verify Identity Access versions 11.0.0 through 11.0.3, including container deployments 11.0.0 and 11.0.3, and IBM Security Verify Access versions 10.0.0 through 10.0.9.2, with container equivalents 10.0.0 and 10.0.9.2, are affected.

The CVSS score of 9.1 indicates a critical severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, leveraging web services or authentication interfaces. Exploitation does not appear to require privileged access; an unauthenticated user could trigger the bypass by sending crafted requests to the authentication endpoint. The potential impact spans data theft, unauthorized configuration changes, and broader compromise of connected systems.