CVE-2026-4364: IBM Verify Access XSS Vulnerability

CVE-2026-4364 Overview

IBM Verify Identity Access Container and IBM Security Verify Access products contain a Cross-Site Scripting (XSS) vulnerability that occurs when certificate listings retrieved via a browser session return a JSON payload while incorrectly specifying the response Content-Type as text/html. Because the content is delivered with an HTML MIME type instead of the appropriate application/json, browsers may interpret the JSON data as executable script under certain conditions, creating an opportunity for JavaScript injection.

Critical Impact

This vulnerability enables potential cross-site scripting attacks through MIME type mismatch, allowing attackers to inject malicious JavaScript that could execute in victims' browsers within the context of the affected application.

Affected Products

• IBM Verify Identity Access Container 11.0 through 11.0.2
• IBM Security Verify Access Container 10.0 through 10.0.9.1
• IBM Verify Identity Access 11.0 through 11.0.2
• IBM Security Verify Access 10.0 through 10.0.9.1

Discovery Timeline

• April 1, 2026 - CVE-2026-4364 published to NVD
• April 1, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4364

Vulnerability Analysis

This vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from an improper Content-Type header configuration in the certificate listing functionality. When users access certificate listings through a browser session, the server returns JSON data but incorrectly sets the Content-Type header to text/html instead of application/json.

This MIME type mismatch can lead to browsers interpreting JSON responses as HTML content. If an attacker can control any portion of the JSON payload—such as certificate names, descriptions, or other user-controllable fields—they could inject malicious JavaScript that browsers would then execute.

The vulnerability requires user interaction, as a victim must visit a malicious link or be redirected to a crafted URL that triggers the vulnerable certificate listing endpoint. The scope is changed, meaning the vulnerability can impact resources beyond the vulnerable component's security scope.

Root Cause

The root cause is the incorrect specification of the HTTP Content-Type response header. The application returns JSON data with a text/html MIME type, violating the principle that response content types should accurately reflect the actual content being served. This misconfiguration bypasses the browser's content-type based security mechanisms that would otherwise prevent script execution in JSON responses.

Attack Vector

The attack requires network access with low complexity but needs the attacker to have low-level privileges (authenticated access) to the system. User interaction is required for successful exploitation. An attacker could craft a malicious certificate entry containing JavaScript code, then trick an authenticated user into viewing the certificate listing. When the browser receives the JSON with HTML Content-Type, it may render and execute the embedded script.

Since no verified code examples are available for this vulnerability, the exploitation mechanism can be described conceptually: The attacker would need to inject JavaScript payloads into certificate metadata fields, which would then be returned in the JSON response. Due to the text/html Content-Type header, browsers may execute any embedded <script> tags or event handlers when rendering the response. For detailed technical information, refer to the IBM Support Page.

Detection Methods for CVE-2026-4364

Indicators of Compromise

• Unusual JavaScript content within certificate listing responses or certificate metadata fields
• HTTP responses from certificate listing endpoints containing Content-Type: text/html headers with JSON body content
• Browser console errors indicating script execution from unexpected sources
• Suspicious certificate entries with HTML or JavaScript-like content in name or description fields

Detection Strategies

• Monitor HTTP responses from IBM Verify/Security Verify Access instances for Content-Type header mismatches where JSON data is served with text/html headers
• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in certificate-related request parameters
• Review application logs for suspicious certificate listing access patterns or unusual user-agent strings
• Deploy Content Security Policy (CSP) headers to restrict script execution sources

Monitoring Recommendations

• Enable verbose logging on IBM Verify Identity Access and Security Verify Access instances to capture certificate listing access events
• Configure SIEM rules to alert on potential XSS attack patterns targeting certificate management endpoints
• Monitor for abnormal certificate creation or modification activities that may indicate payload injection attempts
• Implement browser-side monitoring solutions to detect unexpected script execution in the application context

How to Mitigate CVE-2026-4364

Immediate Actions Required

• Apply the latest security patches from IBM for all affected products as soon as available
• Review and validate Content-Type headers on all API endpoints serving JSON data
• Implement Content Security Policy (CSP) headers to mitigate XSS impact
• Restrict access to certificate listing functionality to only necessary users
• Consider implementing input validation and output encoding for certificate metadata fields

Patch Information

IBM has released security updates addressing this vulnerability. Organizations should review the official IBM Support Page for specific patch details and update instructions. Apply updates to upgrade affected systems:

• IBM Verify Identity Access Container: Update to a version newer than 11.0.2
• IBM Security Verify Access Container: Update to a version newer than 10.0.9.1
• IBM Verify Identity Access: Update to a version newer than 11.0.2
• IBM Security Verify Access: Update to a version newer than 10.0.9.1

Workarounds

• Implement a reverse proxy or WAF rule to force correct Content-Type: application/json headers on certificate listing endpoint responses
• Enable and configure Content Security Policy (CSP) headers with strict script-src directives to prevent inline script execution
• Restrict network access to the certificate management interface to trusted administrative networks only
• Disable or limit browser-based access to certificate listing functionality pending patch deployment

As no verified configuration examples are available, administrators should consult the IBM Support Page for specific workaround implementation guidance and recommended security configurations.