CVE-2013-5429: The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Ti...

Security readout for executives and security teams

CVE-2013-5429 is an authentication-control weakness in IBM Tivoli Federated Identity Manager Risk Based Access. A used one-time password could be reused, reducing the protection expected from OTP-based transaction checks. The attacker described by the sources must already be remotely authenticated. Exposure is likely limited to organizations still running the listed IBM TFIM or TFIMBG 6.2.2 versions with Risk Based Access and OTP transaction flows enabled. Prioritize remediation if TFIM or TFIMBG protects sensitive business transactions. The issue weakens OTP assurance, but the available evidence indicates authenticated access is required and does not confirm active exploitation. Mitigation focus: Upgrade affected TFIM 6.2.2 deployments to FP9 or later per IBM guidance.; Upgrade affected TFIMBG 6.2.2 deployments to FP9 or later per IBM guidance.; Check IBM advisories for any environment-specific remediation instructions..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.