Vulnerability details

CVE-2026-8640

IBM Security Verify DirectoryIBM Verify Directory

IBM Verify Directory is affected by multiple vulnerabilities

CVSS 3.1

3.5Low

Official description

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application.

CVSS scores

Score	Version	Source	Vector
3.5Low	3.1	CVEProject cvelistV5 (CNA) (ibm)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N`

Affected products

Vendor	Product	Versions	Source
IBM	Security Verify Directory	10.0.0 ≤ v ≤ 10.0.4	CVEProject cvelistV5 (CNA)
IBM	Verify Directory	11.0.0	CVEProject cvelistV5 (CNA)

References and advisories

https://www.ibm.com/support/pages/node/7293828 vendor-advisorypatch

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-08
Last updated: 2026-11-08
State: Published
Assigner (CNA): ibm

Exploit prediction (EPSS)

No EPSS score has been published for this CVE yet.

Weaknesses (CWE)

CWE-352
Cross-Site Request Forgery (CSRF)