ibm verify-identity-access CVE-2026-13277 vulnerability in IBM Products
Published on September 14, 2026

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-13277 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
NONE
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is an Open Redirect Vulnerability?

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.

CVE-2026-13277 has been classified to as an Open Redirect vulnerability or weakness.


Products Associated with CVE-2026-13277

Want to know whenever a new CVE is published for IBM products? stack.watch will email you.

IBM Verify Identity Access
 
IBM Security Verify Access
 
IBM Verify Identity Access Container
 
IBM Security Verify Access Container
 

Affected Versions

IBM Verify Identity Access: IBM Security Verify Access: IBM Verify Identity Access Container: IBM Security Verify Access Container: