The vulnerability permits a remote authenticated attacker to bypass security restrictions due to improper authentication, enabling unauthorized access to protected resources and potential escalation of privileges. This flaw is identified as CWE-287, which indicates an authentication bypass weakness and can compromise both confidentiality and integrity when an attacker gains access to sensitive data or configuration settings.

The affected products are IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3, including their container variants. These product families include multiple release levels, such as 10.0.x and 11.0.x, with the latest patched releases being 10.0.9.3 and 11.0.3.1 respectively.

The CVSS score of 8.1 indicates a high severity impact. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability does not appear in CISA's KEV catalog. The likely attack vector requires an authenticated user; once authenticated, the attacker can bypass normal security controls and gain broader privileges. Given the high severity and the need for user credentials, the overall risk is moderate to high for environments that rely on these products without additional mitigations.