CVE-2026-8640 PUBLISHED

IBM Verify Directory is affected by multiple vulnerabilities

Assigner: ibm
Reserved: 14.05.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS Score: 3.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	Security Verify Directory
Versions	affected from 10.0.0 to 10.0.4 (incl.)

Vendor	IBM
Product	Verify Directory
Versions	Version 11.0.0 is affected

Solutions

IBM strongly encourages customers to update their systems promptly.

Product(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4 Download document - https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2 Download document - https://www.ibm.com/support/pages/node/7290214

References

https://www.ibm.com/support/pages/node/7293828

Problem Types

CWE-352 Cross-Site Request Forgery (CSRF) CWE