IBM Verify Identity Access and IBM Security Verify Access versions 11.0 and 10.0 respectively can allow a remote attacker to read sensitive information. The vulnerability arises from an inconsistent interpretation of an HTTP request by a reverse proxy, enabling the attacker to bypass proper request validation and gain unauthorized access to protected data. This is a confidentiality breach as the attacker may obtain data that should remain private. The weakness is classified as CWE‑444, which involves inadequate or inconsistent validation of input data, in this case the HTTP host header.

IBM Verify Identity Access Container 11.0 through 11.0.2, IBM Verify Identity Access 11.0 through 11.0.2, IBM Security Verify Access Container 10.0 through 10.0.9.1, and IBM Security Verify Access 10.0 through 10.0.9.1. These include both standalone and container deployments, with the affected versions specifically listed as 11.0.0 to 11.0.2 for Verify Identity Access and 10.0.0 to 10.0.9.1 for Security Verify Access.

The CVSS score of 5.3 indicates a medium severity impact. EPSS is less than 1%, suggesting a low likelihood of exploitation at the time of disclosure. The issue is not listed in CISA’s KEV catalog. Attackers would need to send specially crafted HTTP requests that the reverse proxy misprocesses, likely from an external network. The absence of a known exploit does not eliminate the risk; however, the exploitability is limited by the need to target the specific reverse proxy configuration used by the affected IBM products.