The described flaw allows the application to handle authentication requests that use HTTP GET, causing user credentials to be placed in the URL. When these URLs are used, the sensitive login data becomes visible in browser history and server logs, leaking passwords to anyone who can access the logs or recall a history entry. This type of disclosure undermines the confidentiality of user accounts and can enable credential reuse attacks.

IBM Security Verify Directory versions 10.0.0 through 10.0.4 and IBM Verify Directory version 11.0.0 are affected. The vendor recommends updating to IBM Security Verify Directory 10.0.4.4 or IBM Verify Directory 11.0.1.2, which contain the fix.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is not available, so the current exploitation probability is uncertain, and the vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector is remote over the network, where an adversary can send a crafted HTTP GET request to the authentication endpoint. If the system is exposed to the internet or within an untrusted internal network, an attacker could stealthily collect stolen passwords in logs or browser history without immediate detection.