Advisory · CVE-2026-16823
Authentication bypass in IBM Security Verify Access
A remote attacker can bypass security restrictions in IBM Security Verify Access due to improper authentication.
- Vendor
- IBM
- Product
- Security Verify Access
- Identifier / CWE
- CVE-2026-16823
CWE-287 - Action timing
- Immediate
Explain it like I’m five
The identity checkpoint has a side gate that does not check badges. Anyone who finds it walks past the guards.
- 01Bypass attempt
A remote attacker targets the improperly authenticated component.
- 02Check skipped
The security restriction that should apply is not enforced.
- 03Access granted
The attacker bypasses authentication controls on the identity platform.
What happened
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication, according to the IBM security bulletin. IBM rates it critical at CVSS 9.1.
An authentication bypass in the product whose entire job is authentication is a category error with a CVE number attached.
What to do
- Inventory Verify Access and Verify Identity Access deployments and confirm versions.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Restrict access to the affected endpoints to trusted networks until patched.
- Review access logs for sessions that should not have been authorized.
Management note
Your identity provider is the keystone. A bypass here does not just affect one application, it affects the trust everything downstream was built on.