CVE-2026-4364: IBM Verify Access XSS Vulnerability

CVE-2026-4364 Overview

IBM Verify Identity Access Container and IBM Security Verify Access products contain a Cross-Site Scripting (XSS) vulnerability that occurs when certificate listings retrieved via a browser session return a JSON payload while incorrectly specifying the response Content-Type as text/html. Because the content is delivered with an HTML MIME type instead of the appropriate application/json, browsers may interpret the JSON data as executable script under certain conditions, creating an opportunity for JavaScript injection.

Critical Impact
This vulnerability enables potential cross-site scripting attacks through MIME type mismatch, allowing attackers to inject malicious JavaScript that could execute in victims' browsers within the context of the affected application.

Affected Products

IBM Verify Identity Access Container 11.0 through 11.0.2
IBM Security Verify Access Container 10.0 through 10.0.9.1
IBM Verify Identity Access 11.0 through 11.0.2
IBM Security Verify Access 10.0 through 10.0.9.1

Discovery Timeline

April 1, 2026 - CVE-2026-4364 published to NVD
April 1, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4364

Vulnerability Analysis

This vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from an improper Content-Type header configuration in the certificate listing functionality. When users access certificate listings through a browser session, the server returns JSON data but incorrectly sets the Content-Type header to text/html instead of application/json.

This MIME type mismatch can lead to browsers interpreting JSON responses as HTML content. If an attacker can control any portion of the JSON payload—such as certificate names, descriptions, or other user-controllable fields—they could inject malicious JavaScript that browsers would then execute.

The vulnerability requires user interaction, as a victim must visit a malicious link or be redirected to a crafted URL that triggers the vulnerable certificate listing endpoint. The scope is changed, meaning the vulnerability can impact resources beyond the vulnerable component's security scope.

Root Cause

The root cause is the incorrect specification of the HTTP Content-Type response header. The application returns JSON data with a text/html MIME type, violating the principle that response content types should accurately reflect the actual content being served. This misconfiguration bypasses the browser's content-type based security mechanisms that would otherwise prevent script execution in JSON responses.

Attack Vector

The attack requires network access with low complexity but needs the attacker to have low-level privileges (authenticated access) to the system. User interaction is required for successful exploitation. An attacker could craft a malicious certificate entry containing JavaScript code, then trick an authenticated user into viewing the certificate listing. When the browser receives the JSON with HTML Content-Type, it may render and execute the embedded script.

Since no verified code examples are available for this vulnerability, the exploitation mechanism can be described conceptually: The attacker would need to inject JavaScript payloads into certificate metadata fields, which would then be returned in the JSON response. Due to the text/html Content-Type header, browsers may execute any embedded <script> tags or event handlers when rendering the response. For detailed technical information, refer to the IBM Support Page.

Detection Methods for CVE-2026-4364

Indicators of Compromise

Unusual JavaScript content within certificate listing responses or certificate metadata fields
HTTP responses from certificate listing endpoints containing Content-Type: text/html headers with JSON body content
Browser console errors indicating script execution from unexpected sources
Suspicious certificate entries with HTML or JavaScript-like content in name or description fields

Detection Strategies

Monitor HTTP responses from IBM Verify/Security Verify Access instances for Content-Type header mismatches where JSON data is served with text/html headers
Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in certificate-related request parameters
Review application logs for suspicious certificate listing access patterns or unusual user-agent strings
Deploy Content Security Policy (CSP) headers to restrict script execution sources

Monitoring Recommendations

Enable verbose logging on IBM Verify Identity Access and Security Verify Access instances to capture certificate listing access events
Configure SIEM rules to alert on potential XSS attack patterns targeting certificate management endpoints
Monitor for abnormal certificate creation or modification activities that may indicate payload injection attempts
Implement browser-side monitoring solutions to detect unexpected script execution in the application context

How to Mitigate CVE-2026-4364

Immediate Actions Required

Apply the latest security patches from IBM for all affected products as soon as available
Review and validate Content-Type headers on all API endpoints serving JSON data
Implement Content Security Policy (CSP) headers to mitigate XSS impact
Restrict access to certificate listing functionality to only necessary users
Consider implementing input validation and output encoding for certificate metadata fields

Patch Information

IBM has released security updates addressing this vulnerability. Organizations should review the official IBM Support Page for specific patch details and update instructions. Apply updates to upgrade affected systems:

IBM Verify Identity Access Container: Update to a version newer than 11.0.2
IBM Security Verify Access Container: Update to a version newer than 10.0.9.1
IBM Verify Identity Access: Update to a version newer than 11.0.2
IBM Security Verify Access: Update to a version newer than 10.0.9.1

Workarounds

Implement a reverse proxy or WAF rule to force correct Content-Type: application/json headers on certificate listing endpoint responses
Enable and configure Content Security Policy (CSP) headers with strict script-src directives to prevent inline script execution
Restrict network access to the certificate management interface to trusted administrative networks only
Disable or limit browser-based access to certificate listing functionality pending patch deployment

As no verified configuration examples are available, administrators should consult the IBM Support Page for specific workaround implementation guidance and recommended security configurations.