Cross-Site Request Forgery Risk in IBM Security Verify Directory Products
CVE-2026-8640

3.5LOW

Key Information:

Vendor

IBM
Status
Security Verify Directory
Verify Directory
Vendor
CVE Published:
8 November 2026

What is CVE-2026-8640?

IBM Security Verify Directory versions 10.0.0 to 10.0.4 and 11.0.0 are susceptible to Cross-Site Request Forgery due to the absence of the SameSite attribute on session cookies. This oversight allows attackers to trick authenticated users into unknowingly sending unauthorized requests to the application. Effective security measures should be implemented to mitigate these risks, including applying available patches and reviewing cookie policies.

Affected Version(s)

Security Verify Directory 10.0.0 <= 10.0.4

Verify Directory 11.0.0

References

https://www.ibm.com/support/pages/node/7293828
vendor-advisorypatch

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.