Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow a remote attacker to access sensitive information due to an inconsistent interpretation of an HTTP request by a reverse proxy.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T20:17:33.797Z",
  "pubdate": "2026-08-12T20:17:33.797Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in IBM Security Verify Access versions 10.0 through 10.0.9.2, IBM Verify Identity Access versions 11.0 through 11.0.3, and IBM Verify Identity Access Container versions 11.0 through 11.0.3. The vulnerability stems from an inconsistent interpretation of HTTP requests by the integrated reverse proxy component.\nA remote, unauthenticated attacker can exploit this discrepancy to bypass security controls and access sensitive information that should otherwise be protected. The flaw allows malicious actors to manipulate HTTP request boundaries, leading to request smuggling or desynchronization anomalies between front-end and back-end parsing engines.\nThe risk implication is significant, as unauthorized retrieval of confidential data may expose session tokens, internal system structures, or sensitive enterprise assets. Successful exploitation requires network connectivity to the vulnerable reverse proxy but does not necessitate prior authentication or privileged access within the affected software.",
  "technicalDetails": "The root cause of the vulnerability resides within the HTTP parsing logic of the reverse proxy component utilized by IBM Security Verify Access and IBM Verify Identity Access. Specifically, the component exhibits ambiguities when processing non-standard, malformed, or ambiguous HTTP headers—such as conflicting Content-Length and Transfer-Encoding headers—leading to an inconsistent interpretation of the HTTP request stream.\nWhen multiple HTTP requests are pipelined or encapsulated within a single TCP connection, discrepancies in how the reverse proxy and the underlying server parse the boundaries of the requests allow the attacker to desynchronize the connection. This technique, commonly known as HTTP request smuggling or request desynchronization, enables the attacker's payload to be appended to or misinterpreted as part of a legitimate, subsequent request processed by the proxy.\nThe attack flow proceeds as follows: First, the remote attacker crafts a specialized HTTP request containing conflicting length-specifying headers or anomalous parsing constructs. Second, the attacker transmits this payload over the network to the exposed reverse proxy interface. Third, due to inconsistent interpretation, the reverse proxy processes the request boundaries differently than expected, isolating or splitting the request stream. Finally, the attacker exploits this desynchronization state to read unauthorized responses containing sensitive information intended for other sessions or administrative interfaces.\nThe vulnerable component is the reverse proxy subsystem handling inbound HTTP traffic across IBM Security Verify Access 10.0 through 10.0.9.2, IBM Verify Identity Access 11.0 through 11.0.3, and IBM Verify Identity Access Container 11.0 through 11.0.3. Exploitation requires network exposure of the reverse proxy endpoint, requires no user interaction, and can be executed remotely by unauthenticated entities without prior system privileges."
}