---
id: "CVE-2026-8860"
page: "https://infrastack.ai/live/CVE-2026-8860"
kind: "vulnerability"
aliases: ["CVE-2026-8860"]
title: "IBM Verify Directory: GET requests accept credentials in URL parameters"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["ibm", "ibm-verify-directory", "self-hosted", "vendor"]
not_affected_if: []
published_at: "2026-11-08T19:17:43+00:00"
first_seen_at: "2026-11-08T19:22:35+00:00"
updated_at: "2026-11-08T19:23:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8860", "first_seen_at": "2026-11-08T19:22:35+00:00"}]
exploit_sources: []
---

# IBM Verify Directory: GET requests accept credentials in URL parameters

Link for people: https://infrastack.ai/live/CVE-2026-8860 (this .md is for agents)

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accept authentication over GET requests with credentials passed as URL parameters. Passwords can then leak into browser history and server logs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-08T19:22:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-8860

## From the sources

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_