{"id":"CVE-2020-4499","aliases":["EUVD-2020-25746","GHSA-jhc9-5xjw-qfg8"],"status":"published","title":"IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an...","description":"IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.","severity":{"version":"3.0","score":7.3,"vector":"CVSS:3.0/I:L/UI:N/AC:L/PR:N/AV:N/C:L/S:U/A:L/RC:C/E:U/RL:O","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01248,"percentile":0.6954,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2020-10-15T12:40:21Z","modified":"2026-06-17T03:20:05Z","products":[{"vendor":"ibm","product":"security access manager"},{"vendor":"ibm","product":"security verify access"},{"vendor":"ibm","product":"security_access_manager"},{"vendor":"ibm","product":"security_verify_access"}],"references":[{"url":"https://www.ibm.com/support/pages/node/6348046","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/182216","tags":["vdb-entry","x_refsource_XF","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-4499"},{"url":"https://github.com/advisories/GHSA-jhc9-5xjw-qfg8"}],"sources":{"cve":[{"id":"CVE-2020-4499","description":"IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.","status":"published","published":"2020-10-15T12:40:21.263Z","modified":"2024-09-17T04:28:43.932Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/I:L/UI:N/AC:L/PR:N/AV:N/C:L/S:U/A:L/RC:C/E:U/RL:O","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:55.460269Z"}],"euvd":[{"id":"EUVD-2020-25746","description":"IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.","status":"published","published":"2020-10-15T12:40:21Z","modified":"2024-09-17T04:28:43Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/I:L/UI:N/AC:L/PR:N/AV:N/C:L/S:U/A:L/RC:C/E:U/RL:O","level":"high"}],"updated_at":"2026-11-03T00:28:23.116921Z"}],"ghsa":[{"id":"GHSA-jhc9-5xjw-qfg8","title":"IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an...","description":"IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.","status":"published","published":"2022-05-24T17:30:45Z","modified":"2023-01-29T05:04:21Z","cwes":["CWE-862"],"updated_at":"2026-11-02T14:45:32.201087Z"}],"nvd":[{"id":"CVE-2020-4499","description":"IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.","status":"published","published":"2020-10-15T13:15:12.913Z","modified":"2026-06-17T03:20:05.297Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:19.351389Z"}]}}