CVE-2026-8640

Full vulnerability record from the local CVENow database.

Description

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application.

Severity

LOW

CVSS score

3.5 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-11-08 19:17:42.723000

Last modified

2026-11-08 19:17:42.837000

View original CVE JSON

{
  "id": "CVE-2026-8640",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-08T19:17:42.723",
  "lastModified": "2026-11-08T19:17:42.837",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "Security Verify Directory",
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "10.0.0",
              "lessThanOrEqual": "10.0.4",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "IBM",
          "product": "Verify Directory",
          "cpes": [
            "cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "11.0.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 1.4
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7293828",
      "source": "[email protected]"
    }
  ]
}