CVE-2026-8860
Awaiting Analysis
Awaiting Analysis - Queue
IBM Security Verify Directory Credential Exposure via GET Requests
Vulnerability report for CVE-2026-8860, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-08
Last updated on: 2026-11-08
Assigner: IBM Corporation
Description
Description
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| IBM | Security Verify Directory | From 10.0.0 (inc) to 10.0.4 (inc) |
| IBM | Verify Directory | 11.0.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-650 | The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state. |
