{"id":"CVE-2026-8640","published":"2026-11-08T19:17:42.723","lastModified":"2026-11-09T19:17:05.553","description":"IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application.","cvssScore":3.5,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7293828","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}