CVE-2026-7364: IBM Verify Access Open Redirect Vulnerability

CVE-2026-7364 Overview

CVE-2026-7364 is an open redirect vulnerability [CWE-601] affecting IBM Verify Identity Access and IBM Security Verify Access product families. The flaw allows a remote attacker to craft a request that redirects an authenticated or unauthenticated user to an arbitrary external website. Attackers typically weaponize this class of issue to support phishing campaigns that abuse the trust of the legitimate IBM domain. Exploitation requires user interaction, such as clicking a crafted link, and does not directly compromise confidentiality, integrity, or availability of the identity platform itself.

Critical Impact
Attackers can send victims links that appear to originate from a trusted IBM Verify Access endpoint but redirect to attacker-controlled infrastructure used for credential harvesting or malware delivery.

Affected Products

IBM Verify Identity Access 11.0 through 11.0.2
IBM Security Verify Access 10.0 through 10.0.9.1
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1

Discovery Timeline

2026-07-17 - CVE-2026-7364 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-7364

Vulnerability Analysis

The vulnerability resides in request handling logic within IBM Verify Identity Access and IBM Security Verify Access. The affected components accept a user-controlled URL parameter and use it to construct an HTTP redirect response without sufficient validation against an allowlist of trusted destinations. This behavior matches the definition of CWE-601, URL Redirection to Untrusted Site. The Exploit Prediction Scoring System reports a probability of 0.302%, indicating a low likelihood of observed exploitation in the near term. Attack complexity is elevated because the attacker must craft the request precisely and lure a user into interacting with it.

Root Cause

The root cause is missing or insufficient validation of a redirect target parameter in the web front end of the identity access products. The application trusts the destination value supplied in the request and issues a 3xx response pointing to that value. Because the initial hostname belongs to the IBM Verify Access deployment, standard user checks of the visible domain give a false sense of legitimacy before the redirect executes.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker builds a URL that targets a vulnerable endpoint on a legitimate IBM Verify Identity Access or Security Verify Access instance and embeds an attacker-controlled destination in the redirect parameter. The victim receives this link through email, chat, or a malicious page. On clicking, the browser first contacts the trusted IBM host and is then redirected to the attacker site, which typically mimics the corporate single sign-on page to capture credentials or session tokens.

No verified public exploit code is available at this time. Technical details are available in the IBM Support Document.

Detection Methods for CVE-2026-7364

Indicators of Compromise

Outbound HTTP 302 or 307 responses from IBM Verify Access endpoints where the Location header points to external, non-corporate domains.
User reports of authentication prompts appearing on unfamiliar domains immediately after clicking a link that started on a trusted IBM Verify Access URL.
Web proxy logs showing referrers from the IBM Verify Access hostname followed by requests to newly registered or typosquatted domains.

Detection Strategies

Inspect access logs on IBM Verify Identity Access and Security Verify Access for requests containing redirect parameters with fully qualified external URLs.
Deploy web application firewall rules that flag redirect parameters resolving to domains outside an approved allowlist.
Correlate authentication events with preceding redirects to detect credential phishing chains that begin at a legitimate IBM host.

Monitoring Recommendations

Forward IBM Verify Access reverse proxy logs to a centralized SIEM and alert on external Location header values.
Monitor DNS and proxy telemetry for lookalike domains impersonating the corporate identity portal.
Track click-through telemetry from email security gateways for URLs that begin with the IBM Verify Access hostname but carry suspicious query strings.

How to Mitigate CVE-2026-7364

Immediate Actions Required

Apply the fixed versions referenced in the IBM Support Document to all IBM Verify Identity Access, IBM Security Verify Access, and their container variants.
Inventory all deployed instances, including containerized deployments, and confirm patch level after remediation.
Notify end users and helpdesk staff about the risk of phishing links that begin with the legitimate IBM Verify Access hostname.

Patch Information

IBM has published remediation guidance in the vendor advisory. Administrators should upgrade IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1, including the corresponding container images, to the fixed releases listed by IBM. Verify patch application by checking the deployed build version against the vendor advisory.

Workarounds

Configure the reverse proxy or upstream WAF to strip or validate redirect parameters against an internal domain allowlist until patches are deployed.
Enforce email security controls that rewrite and inspect URLs pointing to the IBM Verify Access hostname to detect embedded external redirect targets.
Require phishing-resistant multi-factor authentication so that harvested passwords alone cannot be replayed against corporate identity services.

bash

# Example NGINX rule to block external redirect targets in a query parameter
if ($arg_target ~* "^https?://(?!(idp\.example\.com|verify\.example\.com))") {
    return 400;
}