CVE-2026-8860

The IBM Security Verify Directory Web Application is vulnerable to credential exposure because it accepts GET requests for authentication. This allows credentials to be transmitted as URL parameters , which may be captured in browser history and server logs. The affected products are IBM Security...

EUVD-2026-119737

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs...

CVE-2026-8642

The IBM Security Verify Directory Web Application (versions 10.0.0 through 10.0.4 and 11.0.0 ) is vulnerable to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor . The application exposes debug endpoints that reveal internal system details, including server versions and session ...

CVE-2026-8640

The IBM Security Verify Directory Web Application is vulnerable to Cross-Site Request Forgery (CSRF) attacks because it fails to set the SameSite attribute on session cookies. This flaw allows an attacker to induce authenticated users' browsers to transmit unauthorized requests to the application...

EUVD-2026-119735

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the...

CVE-2026-8639 IBM Verify Directory is affected by multiple vulnerabilities

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console...

CVE-2026-8639

IBM Security Verify Directory versions 10.0.0 through 10.0.4 and IBM Verify Directory version 11.0.0 are vulnerable to session fixation (CWE-384). An attacker can establish a session and hijack it after a victim authenticates, leading to unauthorized access to the directory management console. To...

PT-2026-140145

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions...

Security Bulletin: Security Vulnerabilities were found in IBM WebSphere Application Server Liberty provided with IBM Security Verify Directory (CVE-2025-14923)

Summary Security Vulnerabilities were addressed in IBM WebSphere Application Server Liberty provided with IBM Security Verify Directory Vulnerability Details CVEID:CVE-2025-14923 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server...

Security Bulletin: IBM Verify Directory is affected by multiple vulnerabilities (CVE-2026-8639, CVE-2026-8640, CVE-2026-8642, CVE-2026-8860)

Summary Multiple vulnerabilities have been addressed in IBM Verify Directory in an update. Vulnerability Details CVEID:CVE-2026-8642 DESCRIPTION: IBM Security Verify Directory Web Application exposes debug endpoints that disclose system information including server versions and session identifier...

Security Bulletin: Security Vulnerabilities were found in IBM Semeru Runtime Certified Edition provided with IBM Security Verify Directory (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925)

Summary Security Vulnerabilities were addressed in IBM Semeru Runtime Certified Edition provided with IBM Verify Directory Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily exploitable vulnerability issue that allows an remot...

EUVD-2025-209557

IBM Security Verify Directory Container 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against...

IBM Security Directory Integrator Buffer Overflow Auth Bypass

The vulnerability of the IBM Security Directory Integrator and IBM Security Verify Directory Integrator software lies in the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a malicious actor to bypass authentication procedures...