CVE-2026-2475: IBM Security Verify Access Redirect Vulnerability

CVE-2026-2475 Overview

CVE-2026-2475 is an open redirect vulnerability affecting IBM Verify Identity Access and IBM Security Verify Access products, including their containerized deployments. The flaw exists in versions 11.0 through 11.0.2 of IBM Verify Identity Access and versions 10.0 through 10.0.9.1 of IBM Security Verify Access. A remote attacker can craft a malicious request that redirects an authenticated or unauthenticated victim to an arbitrary external website. The issue is categorized under [CWE-601] (URL Redirection to Untrusted Site). Attackers typically abuse such weaknesses to facilitate phishing campaigns against trusted identity infrastructure.

Critical Impact
Attackers can leverage the trusted IBM Verify Access domain to redirect users to attacker-controlled phishing sites, increasing credential theft success rates against identity and access management portals.

Affected Products

IBM Verify Identity Access 11.0 through 11.0.2
IBM Verify Identity Access Container 11.0 through 11.0.2
IBM Security Verify Access 10.0 through 10.0.9.1 (including Container edition)

Discovery Timeline

2026-04-01 - CVE-2026-2475 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-2475

Vulnerability Analysis

The vulnerability stems from improper validation of user-supplied URL parameters used in redirect operations within IBM Verify Identity Access. The product accepts a destination URL in a request parameter and forwards the user without verifying that the target belongs to a trusted domain or allow-list. Exploitation requires user interaction, typically clicking a crafted link that appears to originate from the legitimate IBM Verify Access host. Because identity and access management portals are inherently trusted by end users, this weakness is well-suited for phishing.

The attack changes the scope of impact, allowing the attacker to influence a downstream resource (the victim's browser destination) outside the security authority of the vulnerable component. Confidentiality and availability are not directly impacted, but integrity of the user-facing redirect flow is compromised. The EPSS probability remains low at 0.037%, reflecting limited mass-exploitation interest, though targeted phishing operations rarely require widespread tooling.

Root Cause

The root cause is missing or insufficient validation of the redirect target parameter. The application trusts user-controlled input when constructing HTTP redirect responses, failing to enforce a whitelist of permitted destinations or to verify that the host matches an allowed origin.

Attack Vector

An attacker constructs a URL pointing to a legitimate IBM Verify Access endpoint with a manipulated redirect parameter. The victim receives the link through email, instant message, or a malicious advertisement. After clicking, the victim's browser is silently redirected from the trusted IBM domain to an attacker-controlled site that mimics the legitimate login portal to harvest credentials or deliver malware.

No verified public exploit code is available for CVE-2026-2475. The vulnerability mechanism follows the standard open redirect pattern described in [CWE-601], where a redirect endpoint reflects an untrusted URL parameter into a Location HTTP response header without origin validation. Refer to the IBM Support Page for vendor-specific technical detail.

Detection Methods for CVE-2026-2475

Indicators of Compromise

HTTP requests to IBM Verify Access endpoints containing redirect or return_url parameters with external, non-corporate domains.
Web access logs showing 302 responses from Verify Access hosts with Location headers pointing to untrusted third-party domains.
Spike in user reports of unexpected redirects after clicking links to internal identity portals.

Detection Strategies

Inspect reverse proxy and WAF logs for redirect parameters containing fully qualified URLs, especially those with encoded characters or punycode domains.
Correlate outbound user traffic following Verify Access redirects with threat intelligence feeds of known phishing infrastructure.
Hunt for typosquatted lookalike domains in DNS resolution logs from corporate endpoints shortly after Verify Access portal access.

Monitoring Recommendations

Enable verbose logging on the Verify Access reverse proxy to capture redirect destinations.
Alert on any redirect response where the destination host does not match an internal allow-list.
Monitor user-reported phishing submissions referencing Verify Access URLs.

How to Mitigate CVE-2026-2475

Immediate Actions Required

Apply the IBM-provided fix referenced in the IBM Support advisory to all Verify Identity Access and Security Verify Access deployments, including container images.
Inventory all 10.0.x and 11.0.x installations to confirm patch coverage across production, staging, and disaster recovery environments.
Educate end users that legitimate IBM Verify Access links should not redirect to external domains during authentication flows.

Patch Information

IBM has published remediation guidance on its support portal. Administrators should upgrade beyond IBM Verify Identity Access 11.0.2 and IBM Security Verify Access 10.0.9.1 to the fixed releases identified in the IBM Support Page. Both bare-metal and container deployments require updating.

Workarounds

Configure the upstream reverse proxy or WAF to strip or validate redirect parameters destined for Verify Access endpoints.
Implement a strict allow-list of permitted redirect targets at the network edge until patches are deployed.
Disable or restrict any Verify Access features that accept user-supplied redirect URLs if business workflows permit.

bash

# Example WAF rule (ModSecurity) to block external redirect targets
SecRule ARGS:return_url|ARGS:redirect|ARGS:url "@rx ^https?://(?!verify\.example\.corp)" \
    "id:1002475,phase:2,deny,status:403,\
    msg:'CVE-2026-2475 - external redirect blocked',\
    tag:'CWE-601'"