An open redirect flaw in IBM Verify Identity Access and IBM Security Verify Access allows a remote attacker to craft a request that redirects a user to an arbitrary website. This can be exploited to create convincing phishing pages, potentially leading a victim to divulge sensitive credentials or personal information. The vulnerability does not provide direct code execution or data disclosure, but the impact lies in facilitating credential theft and social engineering attacks.

IBM Verify Identity Access versions 11.0 through 11.0.2 and IBM Security Verify Access versions 10.0 through 10.0.9.1, including their corresponding container editions, are affected. The specific affected releases are Verify Identity Access 11.0, 11.0.2 and Security Verify Access 10.0, 10.0.9.1.

The CVSS score is 3.1, indicating low severity. EPSS is below 1%, signifying a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending a specially crafted HTTP request; the victim must click a link to trigger the redirect, so social engineering is a prerequisite.