High priorityDisclosed

Advisory · CVE-2026-17189

Cross-site scripting in IBM Security Verify Access Web UI

An unauthenticated user can embed arbitrary JavaScript in the IBM Security Verify Access Web UI, potentially stealing credentials from trusted sessions.

Advisory published October 8, 2026Independent summary
Vendor
IBM
Product
Security Verify Access
Identifier / CWE
CVE-2026-17189
CWE-79
Action timing
Immediate
ELI5

Explain it like I’m five

The login page has a suggestion box where anyone can leave a note. The notes run as instructions in the browser of whoever logs in next.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Injected script

    An unauthenticated user embeds arbitrary JavaScript in the Web UI.

  2. 02Victim visits

    A legitimate user opens the affected page in a trusted session.

  3. 03Session abuse

    The script runs in the trusted session, potentially disclosing credentials.

What happened

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting, according to the IBM security bulletin. An unauthenticated user can embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. IBM rates it high at CVSS 8.2.

What to do

  1. Inventory Verify Access and Verify Identity Access deployments and confirm versions.
  2. Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
  3. Until patched, treat the Web UI as hostile: avoid logging in from shared machines and review recent login sessions.
  4. Consider rotating credentials for administrators who used the affected Web UI.

Management note

XSS on the login surface of the identity provider is a credential-harvesting opportunity aimed at your most privileged users. It earns its place in this patch batch.