Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
Published: 2026-11-07
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Account Takeover via Open Redirect
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows a malicious actor to manipulate the redirect URL used during the sign‑in process, enabling the attacker to receive authentication results at a domain controlled by them. This can lead to credential theft or the ability to impersonate a legitimate user, effectively resulting in a full account takeover. The weakness is classified as CWE‑601.

Affected Systems

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to this flaw.

Risk and Exploitability

The flaw carries a CVSS score of 9.6, indicating a critical level of severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by interacting with the sign‑in mechanism and supplying a crafted redirect URL. Prompt remediation is strongly advised.

Generated by OpenCVE AI on November 7, 2026 at 07:11 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade IBM API Connect to v12.1.1.3 or to v10.0.8.13 as recommended by IBM.
  • If an upgrade is not immediately feasible, disable or remove the application’s redirect functionality to prevent attackers from influencing post‑authentication redirects.
  • Make sure that any remaining redirect capabilities are strictly validated against a pre‑defined whitelist so that redirects can only point to trusted domains.

Generated by OpenCVE AI on November 7, 2026 at 07:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-601
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:32:49.804Z

Reserved: 2026-07-25T00:48:03.882Z

Link: CVE-2026-17297

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:37.333

Modified: 2026-11-07T05:18:37.470

Link: CVE-2026-17297

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T12:00:15Z

Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')