CVE-2020-4461: IBM Security Access Manager

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing id_token claims manipulation without verification. IBM X-Force ID: 181481.

Affected products

• IBM Security Access Manager: from 9.0, before 9.0.7.1 (fixed in 9.0.7.1)

Published 2020-05-20. Last modified 2026-06-17.