The vulnerability stems from improper authentication mechanisms in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3. A remote attacker can exploit this flaw to bypass authentication, gaining unauthorized access to protected resources. The weakness, classified as CWE-287, means the system fails to verify user identity correctly, potentially allowing full control over the application.

Affected vendors include IBM, with products IBM Security Verify Access versions 10.0 to 10.0.9.2 and IBM Verify Identity Access versions 11.0 to 11.0.3. Container variants are also vulnerable: IBM Security Verify Access Container 10.0 to 10.0.9.2 and IBM Verify Identity Access Container 11.0 to 11.0.3.

The CVSS base score of 9.1 indicates high severity. Although no EPSS score is available and the vulnerability is not listed in the KEV catalog, the potential impact remains significant. The flaw can be exploited by an attacker with network access to the affected services; the likely attack vector is remote. Immediate patching is essential to prevent credential theft or broader system compromise.