{"id":"CVE-2026-8640","kind":"vulnerability","aliases":["CVE-2026-8640"],"related":[],"title":"IBM Verify Directory: missing SameSite cookie flag enables cross-site request forgery","description":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application.","summary":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 do not set the SameSite attribute on session cookies. An attacker can make a logged-in user's browser send unauthorized requests to the application.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm","identity","vendor","verify-directory"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-08T19:17:42+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","triaged_at":"2026-11-08T19:23:30+00:00","updated_at":"2026-11-08T19:23:30+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T19:23:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM Verify Directory: missing SameSite cookie flag enables cross-site request forgery","impact":"low","summary":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 do not set the SameSite attribute on session cookies. An attacker can make a logged-in user's browser send unauthorized requests to the application.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","verify-directory","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Authenticated users' browsers send unauthorized requests to the application","analyst_note":"Check the IBM security bulletin for affected versions and the fixed release; sources give none.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM Security Verify Directory 10.0.0 through 10.0.4 or IBM Verify Directory 11.0.0 with logged-in users. Deployments on other versions are not named in the sources. The sources do not say what default configuration or features are needed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000699,"input_tokens":4586,"output_tokens":481,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-8640':16A,19A '10.0.0':30B,68C '10.0.4':32B,70C '11.0.0':37B,75C 'applic':63B,109C 'attack':48B,95C,97C 'attribut':43B,81C 'authent':100C 'browser':57B,102C 'caus':99C 'cooki':6A,46B,84C 'cross':10A,90C 'cross-sit':9A,89C 'csrf':94C 'cve':14A,17A 'directori':3A,25B,29B,36B,67C,74C 'enabl':8A 'flag':7A 'forgeri':13A,93C 'ibm':1A,20B,26B,34B,64C,72C 'ident':21B 'log':53B 'logged-in':52B 'make':50B,85C 'miss':4A 'request':12A,60B,92C,106C 'samesit':5A,42B,80C 'secur':27B,65C 'send':58B,104C 'session':45B,83C 'set':40B,78C 'site':11A,91C 'unauthor':59B,105C 'user':55B,101C 'vendor':22B 'verifi':2A,24B,28B,35B,66C,73C 'verify-directori':23B 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Security Verify Directory 10.0.0 through 10.0.4 or IBM Verify Directory 11.0.0 with logged-in users. Deployments on other versions are not named in the sources. The sources do not say what default configuration or features are needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibm","identity","low","vendor","verifydirectory"],"campaign_type":null,"search_a":"'-2026':15A,18A '-8640':16A,19A 'cooki':6A 'cross':10A 'cross-sit':9A 'cve':14A,17A 'directori':3A 'enabl':8A 'flag':7A 'forgeri':13A 'ibm':1A 'miss':4A 'request':12A 'samesit':5A 'site':11A 'verifi':2A","search_b":"'10.0.0':30B '10.0.4':32B '11.0.0':37B 'applic':63B 'attack':48B 'attribut':43B 'browser':57B 'cooki':46B 'directori':25B,29B,36B 'ibm':20B,26B,34B 'ident':21B 'log':53B 'logged-in':52B 'make':50B 'request':60B 'samesit':42B 'secur':27B 'send':58B 'session':45B 'set':40B 'unauthor':59B 'user':55B 'vendor':22B 'verifi':24B,28B,35B 'verify-directori':23B","search_c":"'10.0.0':68C '10.0.4':70C '11.0.0':75C 'applic':109C 'attack':95C,97C 'attribut':81C 'authent':100C 'browser':102C 'caus':99C 'cooki':84C 'cross':90C 'cross-sit':89C 'csrf':94C 'directori':67C,74C 'forgeri':93C 'ibm':64C,72C 'make':85C 'request':92C,106C 'samesit':80C 'secur':65C 'send':104C 'session':83C 'set':78C 'site':91C 'unauthor':105C 'user':101C 'verifi':66C,73C 'vulner':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-8640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8640","severity":null,"published_at":"2026-11-08T19:17:42+00:00","modified_at":"2026-11-08T19:17:42+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","fetched_at":"2026-11-08T19:22:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}