A critical flaw in IBM Verify Identity Access and IBM Security Verify Access allows an attacker to bypass authentication under certain load conditions, granting unauthorized access to the application. The vulnerability is classified as Authentication Bypass (CWE‑287) and can lead to unauthorized data exposure, configuration changes, or lateral movement within the platform.

Affected versions include IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1, along with their corresponding container editions. Patches are available as Verify Identity Access 11.0.2 IF1 and Security Verify Access 10.0.9.1 IF1.

The CVSS v3.1 base score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a low probability of public exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is remote exploitation triggered by load-induced authentication failures; an attacker would need to generate traffic that stresses authentication mechanisms to activate the flaw.