CVE-2026-1343: IBM Security Verify Access Auth Bypass Flaw

CVE-2026-1343 Overview

CVE-2026-1343 is a Server-Side Request Forgery (SSRF) vulnerability affecting IBM Verify Identity Access and IBM Security Verify Access products. The vulnerability allows an attacker to contact internal authentication endpoints that are intended to be protected by the Reverse Proxy. This flaw can be exploited remotely without authentication, enabling attackers to bypass access controls and potentially interact with sensitive internal services.

Critical Impact

Attackers can bypass the Reverse Proxy protections to access internal authentication endpoints, potentially leading to unauthorized access to protected resources, credential theft, or further exploitation of internal systems.

Affected Products

• IBM Verify Identity Access Container 11.0 through 11.0.2
• IBM Security Verify Access Container 10.0 through 10.0.9.1
• IBM Verify Identity Access 11.0 through 11.0.2
• IBM Security Verify Access 10.0 through 10.0.9.1

Discovery Timeline

• 2026-04-08 - CVE-2026-1343 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-1343

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery), a weakness where an application can be manipulated to send crafted requests from the server to unintended destinations. In this case, the IBM Verify Identity Access and Security Verify Access products fail to properly validate and restrict requests, allowing attackers to reach internal authentication endpoints that should only be accessible through the Reverse Proxy.

The SSRF vulnerability enables attackers to bypass the security boundary established by the Reverse Proxy, which is designed to protect sensitive internal authentication services from direct external access. By crafting malicious requests, an attacker can force the server to make requests to internal endpoints on their behalf.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and inadequate request filtering within the affected IBM products. The application does not properly sanitize or restrict URLs or endpoint parameters, allowing attackers to specify internal targets that should be unreachable from external networks. The Reverse Proxy configuration fails to adequately block or filter requests destined for internal authentication services.

Attack Vector

The attack can be executed remotely over the network without requiring authentication. An attacker crafts a specially designed request that exploits the SSRF vulnerability to direct the server to contact internal authentication endpoints. This network-based attack has low complexity, requires no user interaction, and can affect resources beyond the vulnerable component's security scope.

The exploitation process involves:

1. An attacker sends a crafted request to the vulnerable IBM application
2. The application processes the request without proper validation
3. The server initiates a connection to internal authentication endpoints
4. The attacker receives responses or can infer information about internal services
5. This access can be leveraged for credential theft, data exfiltration, or further attacks

Detection Methods for CVE-2026-1343

Indicators of Compromise

• Unusual outbound requests from the Reverse Proxy to internal authentication service endpoints
• Unexpected authentication log entries from internal IP addresses or services
• Anomalous traffic patterns indicating SSRF exploitation attempts
• Error logs showing failed or unexpected connections to internal endpoints

Detection Strategies

• Implement network monitoring to detect unusual traffic between the Reverse Proxy and internal authentication endpoints
• Review web application firewall (WAF) logs for suspicious URL patterns or SSRF-indicative payloads
• Configure intrusion detection systems (IDS) to alert on requests targeting internal IP ranges from external sources
• Audit authentication logs for anomalies indicating unauthorized endpoint access

Monitoring Recommendations

• Enable detailed logging for all Reverse Proxy and authentication service activities
• Set up real-time alerts for requests attempting to reach internal endpoints through abnormal paths
• Monitor for increased connection attempts to internal services during non-business hours
• Implement behavioral analytics to detect deviation from normal authentication traffic patterns

How to Mitigate CVE-2026-1343

Immediate Actions Required

• Review and apply IBM security patches from the IBM Support Page
• Audit Reverse Proxy configurations to ensure internal endpoints are properly protected
• Implement network segmentation to limit access to internal authentication services
• Deploy WAF rules to block common SSRF attack patterns

Patch Information

IBM has released security updates to address this vulnerability. Organizations should apply the latest patches available through the IBM Support Page. Affected customers should upgrade:

• IBM Verify Identity Access Container to versions beyond 11.0.2
• IBM Security Verify Access Container to versions beyond 10.0.9.1
• IBM Verify Identity Access to versions beyond 11.0.2
• IBM Security Verify Access to versions beyond 10.0.9.1

Workarounds

• Implement strict network access control lists (ACLs) to prevent direct access to internal authentication endpoints
• Configure the Reverse Proxy with explicit allowlists for permitted internal destinations
• Deploy application-level firewalls with SSRF-specific rulesets
• Use network segmentation to isolate authentication services from potentially vulnerable application tiers

# Example: Restrict internal endpoint access via firewall rules
# Block direct access to internal auth endpoints from external networks
iptables -A INPUT -s 0.0.0.0/0 -d 10.0.0.0/8 -p tcp --dport 443 -j DROP
iptables -A INPUT -s 0.0.0.0/0 -d 172.16.0.0/12 -p tcp --dport 443 -j DROP
iptables -A INPUT -s 0.0.0.0/0 -d 192.168.0.0/16 -p tcp --dport 443 -j DROP