The vulnerability allows an attacker to cause a denial of service by exploiting uncontrolled recursion within the authentication flow of IBM Verify Identity Access and IBM Security Verify Access. This flaw is categorized as CWE‑674, meaning recursive calls are not properly limited, leading to resource exhaustion and eventual service crash. Remote exploitation is possible, which means an attacker does not need local access but can trigger the denial of service from a remote location.

IBM Verify Identity Access versions 11.0 through 11.0.3 and IBM Security Verify Access versions 10.0 through 10.0.9.2 are affected, along with their corresponding container variants. These products provide identity and access management services and are typically deployed in enterprise environments requiring high availability.

With a CVSS score of 5.9, the vulnerability presents a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. However, remote denial of service can disrupt authentication services and impact business continuity, so the risk is considered significant for organizations that rely on these products. There are no documented work‑arounds, making a patch the only reliable mitigation. The attack can be carried out without privileged access, emphasizing the need for timely remediation.