Advisory · CVE-2026-19491
Authentication bypass in IBM Security Verify Access
A remote attacker can bypass authentication in IBM Security Verify Access due to improper authentication handling.
- Vendor
- IBM
- Product
- Security Verify Access
- Identifier / CWE
- CVE-2026-19491
CWE-287 - Action timing
- Immediate
Explain it like I’m five
Same vault, different side gate: the badge reader on this door can be convinced you already showed a badge, without ever seeing one.
- 01Bypass attempt
A remote attacker targets the improperly authenticated component.
- 02Check skipped
The authentication control does not hold.
- 03Access granted
The attacker bypasses authentication on the identity platform.
What happened
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication, according to the IBM security bulletin. IBM rates it critical at CVSS 9.1. It arrives in the same bulletin batch as another authentication bypass, which suggests the auth plumbing deserves a hard look.
What to do
- Inventory Verify Access and Verify Identity Access deployments and confirm versions.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Restrict access to the affected endpoints to trusted networks until patched.
- Review access logs for sessions that should not have been authorized.
Management note
Two unauthenticated auth-bypass CVEs in one bulletin for the identity platform is a pattern, not a coincidence. Treat the whole deployment as suspect until patched.