{"id":"CVE-2026-8860","kind":"vulnerability","aliases":["CVE-2026-8860"],"related":[],"title":"IBM Verify Directory: GET requests accept credentials in URL parameters","description":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.","summary":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accept authentication over GET requests with credentials passed as URL parameters. Passwords can then leak into browser history and server logs.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm","ibm-verify-directory","self-hosted","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-08T19:17:43+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","triaged_at":"2026-11-08T19:23:14+00:00","updated_at":"2026-11-08T19:23:14+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T19:23:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Verify Directory: GET requests accept credentials in URL parameters","impact":"medium","summary":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accept authentication over GET requests with credentials passed as URL parameters. Passwords can then leak into browser history and server logs.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","ibm-verify-directory","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"passwords readable from browser history and server logs","analyst_note":"Check the IBM security bulletin for fixed versions and any configuration workaround; the NVD entry does not state them.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running IBM Security Verify Directory 10.0.0 through 10.0.4 or IBM Verify Directory 11.0.0. Anyone who can view browser history or server logs where these requests land could read the passwords. The sources do not describe further conditions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4560,"output_tokens":458,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-8860':13A,16A '10.0.0':30B,63C '10.0.4':32B,65C '11.0.0':37B,70C 'accept':6A,38B,71C 'allow':76C 'authent':39B,75C 'browser':54B,91C 'caus':85C 'credenti':7A,44B,77C 'cve':11A,14A 'directori':3A,21B,29B,36B,62C,69C 'expos':89C 'get':4A,41B,72C 'histori':55B,92C 'host':24B 'ibm':1A,17B,19B,26B,34B,59C,67C 'ibm-verify-directori':18B 'leak':52B 'log':58B,95C 'paramet':10A,48B,83C 'pass':45B,80C 'password':49B,86C 'request':5A,42B,73C 'secur':27B,60C 'self':23B 'self-host':22B 'server':57B,94C 'url':9A,47B,82C 'vendor':25B 'verifi':2A,20B,28B,35B,61C,68C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Security Verify Directory 10.0.0 through 10.0.4 or IBM Verify Directory 11.0.0. Anyone who can view browser history or server logs where these requests land could read the passwords. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibm","ibmverifydirectory","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':12A,15A '-8860':13A,16A 'accept':6A 'credenti':7A 'cve':11A,14A 'directori':3A 'get':4A 'ibm':1A 'paramet':10A 'request':5A 'url':9A 'verifi':2A","search_b":"'10.0.0':30B '10.0.4':32B '11.0.0':37B 'accept':38B 'authent':39B 'browser':54B 'credenti':44B 'directori':21B,29B,36B 'get':41B 'histori':55B 'host':24B 'ibm':17B,19B,26B,34B 'ibm-verify-directori':18B 'leak':52B 'log':58B 'paramet':48B 'pass':45B 'password':49B 'request':42B 'secur':27B 'self':23B 'self-host':22B 'server':57B 'url':47B 'vendor':25B 'verifi':20B,28B,35B","search_c":"'10.0.0':63C '10.0.4':65C '11.0.0':70C 'accept':71C 'allow':76C 'authent':75C 'browser':91C 'caus':85C 'credenti':77C 'directori':62C,69C 'expos':89C 'get':72C 'histori':92C 'ibm':59C,67C 'log':95C 'paramet':83C 'pass':80C 'password':86C 'request':73C 'secur':60C 'server':94C 'url':82C 'verifi':61C,68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-8860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8860","severity":null,"published_at":"2026-11-08T19:17:43+00:00","modified_at":"2026-11-08T19:17:43+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","fetched_at":"2026-11-08T19:22:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}