CVE-2026-8860 PUBLISHED

IBM Verify Directory is affected by multiple vulnerabilities

Assigner: ibm
Reserved: 18.05.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	Security Verify Directory
Versions	affected from 10.0.0 to 10.0.4 (incl.)

Vendor	IBM
Product	Verify Directory
Versions	Version 11.0.0 is affected

Solutions

IBM strongly encourages customers to update their systems promptly.

Product(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4 Download document - https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2 Download document - https://www.ibm.com/support/pages/node/7290214

References

https://www.ibm.com/support/pages/node/7293828

Problem Types

CWE-650 Trusting HTTP Permission Methods on the Server Side CWE