PT-2026-140146

CVE-2026-8860

·

Published

2026-11-08

·

Updated

2026-11-08

Description by

CVSS 3.1
6.5
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.
Exploitability
Fix
Vendors
Affected products
Weakness enumeration
CWE-650: Trusting HTTP Permission Methods on the Server Side
Related identifiers
CVE-2026-8860
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com