This is HTTP Request Smuggling (CWE-444) in IBM Security Verify Access and IBM Security Identity Access — specifically, an inconsistent interpretation of HTTP request boundaries in the bundled reverse proxy layer. That's the critical detail: this isn't a flaw in upstream infrastructure or a third-party load balancer you can swap out. It's baked into the enforcement layer itself, which means the security boundary controlling authentication and authorization decisions is where the parsing disagreement lives. If an attacker can smuggle a request past the proxy, they've already bypassed the access control layer for everything behind it.
The vulnerability affects both 10.x and 11.x version streams, with patches at 10.0.9.2 and 11.0.3. The identical patch boundary across major version migrations is itself informative — it suggests the same parsing code survived unchanged through IBM's containerization rewrite, preserved either as "legacy support" or simply because no one owned threat-modeling that code path during the architectural change. That's the red flag: deprecated code that ships unchanged carries forward not just functionality but vulnerability surface.
For defenders, three priorities matter. First, confirm your version — 10.0.9.2 and 11.0.3 are the fixed releases, but organizations running 10.x through 10.0.9.1 or 11.0 through 11.0.2 are actively exposed. Second, audit your topology: if you're fronting ISVA with nginx, Apache, or another reverse proxy, you now have a two-layer smuggling scenario where IBM's proxy and your upstream proxy may interpret request boundaries differently, creating compound attack surface. Third, treat this as a forcing function for IAM proxy testing — this vulnerability class has a documented recurrence in access management products specifically, because the proxy layer is often treated as "plumbing" rather than security-critical code requiring differential fuzzing against multiple backend interpretations.
The CVSS 8.1 score likely reflects a conservative interpretation. In an IAM context, "access sensitive information" could mean session tokens, access policies, user attributes, or downstream credentials — the actual impact ceiling depends on what backend APIs become reachable through smuggling. Push IBM for clarity on which authenticated endpoints become reachable through this vector.