IBM Verify Directory <=10.0.4 & 11.0.0 Session Fixation
CVE-2026-8639 Published on November 8, 2026
IBM Verify Directory is affected by multiple vulnerabilities
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.
Vulnerability Analysis
CVE-2026-8639 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Products Associated with CVE-2026-8639
stack.watch emails you whenever new vulnerabilities are published in IBM Security Verify Directory or IBM Verify Directory. Just hit a watch button to start following.
