CVE-2026-8860

Full vulnerability record from the local CVENow database.

Description

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.

Severity

MEDIUM

CVSS score

6.5 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-11-08 19:17:43.020000

Last modified

2026-11-08 19:17:43.137000

View original CVE JSON

{
  "id": "CVE-2026-8860",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-08T19:17:43.020",
  "lastModified": "2026-11-08T19:17:43.137",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "Security Verify Directory",
          "cpes": [
            "cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "10.0.0",
              "lessThanOrEqual": "10.0.4",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "IBM",
          "product": "Verify Directory",
          "cpes": [
            "cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "11.0.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-650"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7293828",
      "source": "[email protected]"
    }
  ]
}