CVE-2024-45647 is a medium severity (CVSS 5.6) flaw in IBM Security Verify Access and its Docker image, versions 10.0.0 through 10.0.8. An unverified user could change the password of an expired account without knowing the old one. IBM says it is fixed in 10.0.9 or later.
What's affected
IBM lists IBM Security Verify Access 10.0.X and IBM Security Verify Access Docker 10.0.X as affected. The NVD record narrows that to 10.0.0 through 10.0.8.
IBM states the fix is IBM Security Verify Access 10.0.9 or later. IBM also says that using IBM Security Verify Directory 10.0.3 or later fixes the problem.
The bulletin adds an important condition: the issue is only found when the product is used with the IBM Security Directory Server as the backend. If you use a different directory, check the bulletin before treating the whole fleet as exposed.
How to check if you're exposed
Find the running version on each appliance or container, and find out which directory server sits behind it.
For the Docker image, check the image tag in your deployment files and registry.
docker ps --format "table {{.Names}}\t{{.Image}}" | grep -i verify
For appliances, use the administration console or the firmware information page to read the version. Then confirm with your identity team whether the backend is IBM Security Directory Server. If the version is 10.0.8 or lower and the backend is that directory server, treat the system as affected.
What to do now
- Inventory every Verify Access appliance and container and record the version.
- Confirm which instances use IBM Security Directory Server as the backend.
- Upgrade to Verify Access 10.0.9 or later, or move the directory to Verify Directory 10.0.3 or later, as IBM describes.
- If you cannot upgrade yet, apply the IBM workaround by setting the IDS_NEW_PASSWORD_POLICY=YES environment variable on the backend server, before it starts, as the bulletin describes.
- Review recent password changes on accounts that were expired, and ask owners to confirm any they did not make.
Why it matters
The weakness is CWE-620 (Unverified Password Change). A password change should require proof that the person is who they claim to be, usually the current password or a verified reset token. Expired accounts are a special case, because the system has to let a user set a new password without a valid session. If that path skips verification, it becomes a way to take over the account.
The CVSS vector gives high attack complexity, which is why the score is only medium. Still, an identity gateway is a trusted component, and a takeover of an expired account can matter more than the number suggests. The record does not flag this CVE as exploited, and it is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-45647.
Quick check
Which versions fix CVE-2024-45647?
IBM says Security Verify Access 10.0.9 or later fixes it, and Security Verify Directory 10.0.3 or later also fixes it.
Does it affect every Verify Access deployment?
IBM says the issue is only found when using the IBM Security Directory Server, so confirm your backend first.
Sources
Last reviewed: 19 October 2026.
