CVE-2026-2475: IBM Verify Access Open Redirect Vulnerability

CVE-2026-2475 Overview

CVE-2026-2475 is an Open Redirect vulnerability (CWE-601) affecting IBM Verify Identity Access and IBM Security Verify Access products. This flaw allows remote attackers to conduct phishing attacks by exploiting improper URL validation, enabling them to redirect victims to arbitrary malicious websites through specially crafted requests.

Critical Impact

Attackers can exploit this open redirect vulnerability to redirect authenticated users to malicious sites, potentially enabling credential theft, malware distribution, or further phishing attacks while leveraging the trusted IBM domain.

Affected Products

• IBM Verify Identity Access Container 11.0 through 11.0.2
• IBM Security Verify Access Container 10.0 through 10.0.9.1
• IBM Verify Identity Access 11.0 through 11.0.2
• IBM Security Verify Access 10.0 through 10.0.9.1

Discovery Timeline

• April 1, 2026 - CVE-2026-2475 published to NVD
• April 1, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2475

Vulnerability Analysis

This vulnerability stems from improper input validation of URL redirection parameters within the IBM Verify Identity Access and Security Verify Access products. When processing redirect URLs, the application fails to adequately validate the target destination, allowing attackers to craft malicious URLs that appear legitimate but redirect users to attacker-controlled domains.

The open redirect vulnerability is particularly concerning in identity and access management systems, as users inherently trust these authentication endpoints. An attacker can leverage this trust to construct phishing campaigns that appear to originate from the legitimate IBM authentication infrastructure.

Root Cause

The root cause is classified as CWE-601 (URL Redirection to Untrusted Site, also known as Open Redirect). The application accepts user-controlled input for URL redirection without proper validation or sanitization. This allows external, untrusted URLs to be used as redirect destinations, bypassing the intended security boundary of keeping users within the trusted application domain.

Attack Vector

The attack requires network access and user interaction, where an attacker crafts a malicious URL containing a redirect parameter pointing to a phishing site. The attack flow typically involves:

1. Attacker identifies a redirect parameter in the IBM Verify Identity Access or Security Verify Access application
2. Attacker constructs a URL using the legitimate IBM domain with a malicious redirect destination
3. The malicious link is distributed via email, social engineering, or other means
4. When a victim clicks the link, they are first directed to the legitimate IBM endpoint
5. The application then redirects the victim to the attacker-controlled malicious site
6. The victim, having seen the trusted IBM domain, may be more likely to trust the destination and provide credentials or sensitive information

The attack mechanism exploits the implicit trust users place in legitimate domains. Since the initial URL appears to belong to IBM's authentication infrastructure, security-conscious users and even some URL filtering systems may not flag the link as suspicious.

Detection Methods for CVE-2026-2475

Indicators of Compromise

• Unusual redirect parameters in URL requests to IBM Verify Identity Access endpoints containing external domain references
• Web server logs showing redirect responses (HTTP 302/303) to external, untrusted domains
• User reports of being redirected to unexpected websites after clicking links to IBM authentication services

Detection Strategies

• Monitor web application firewall (WAF) logs for requests containing URL parameters with external domain references
• Implement URL pattern matching rules to detect redirect parameters pointing to non-whitelisted domains
• Review authentication logs for unusual redirect patterns or destinations outside the expected application scope
• Configure SentinelOne Singularity to monitor endpoint browser activity for suspicious redirect chains originating from IBM authentication URLs

Monitoring Recommendations

• Enable detailed logging for all redirect operations within IBM Verify Identity Access and Security Verify Access deployments
• Configure alerting for redirect requests that specify destinations outside the organization's trusted domain list
• Implement periodic log analysis to identify patterns of redirect abuse attempts

How to Mitigate CVE-2026-2475

Immediate Actions Required

• Apply the security patch provided by IBM for all affected IBM Verify Identity Access and Security Verify Access installations
• Review and audit all redirect functionality within the application for proper URL validation
• Implement allow-list validation for all redirect destinations to restrict redirects to trusted domains only
• Educate users about the risk of phishing attacks leveraging open redirect vulnerabilities

Patch Information

IBM has released a security patch addressing this vulnerability. Administrators should obtain and apply the patch from the IBM Security Patch Advisory (Node 7268253). The patch should be applied to all affected versions:

• IBM Verify Identity Access Container versions 11.0 through 11.0.2
• IBM Security Verify Access Container versions 10.0 through 10.0.9.1
• IBM Verify Identity Access versions 11.0 through 11.0.2
• IBM Security Verify Access versions 10.0 through 10.0.9.1

Workarounds

• Implement a web application firewall (WAF) rule to block or sanitize redirect parameters containing external domain references
• Configure reverse proxy or load balancer rules to validate redirect destinations before allowing the request to reach the application
• Restrict access to authentication endpoints to only necessary networks until the patch can be applied
• Implement Content Security Policy (CSP) headers to limit redirect destinations where possible

# Example WAF rule to block external redirects (ModSecurity syntax)
SecRule ARGS:redirect_uri "!@beginsWith https://trusted-domain.example.com" \
    "id:1001,phase:1,deny,status:403,msg:'Blocked potential open redirect attempt'"