CVE-2013-5431: Open redirect vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.1.1 before IF 15, 6.2.0 befor...

Security readout for executives and security teams

This is an open redirect in IBM Tivoli Federated Identity Manager and Business Gateway. An attacker could abuse vulnerable identity flows to send users to attacker-controlled sites, supporting phishing. Sources do not provide CVSS, exploit details, or active exploitation evidence. Business urgency depends on whether legacy TFIM or TFIMBG remains exposed to users or partners. Likely limited to organizations still running legacy IBM TFIM or TFIMBG versions, especially internet-facing federation, SSO, or partner identity endpoints. The provided affected-product metadata is incomplete, so inventory confirmation is essential. Treat as a targeted legacy identity-system risk, not a crisis by itself. Prioritize remediation if TFIM or TFIMBG is still internet-facing or trusted by employees, customers, or partners, because phishing through a trusted identity domain can materially increase credential-theft risk. Mitigation focus: Inventory IBM TFIM and TFIMBG deployments and exposed identity endpoints.; Apply IBM interim fixes: 6.1.1 IF15, 6.2.0 IF14, or 6.2.2 IF8 or later.; For TFIM 6.2.1, check IBM advisory guidance for the supported fixed path..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.