CVE-2026-17297

Overview

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain an open redirect flaw in the sign-in flow that can lead to account takeover. The flaw allows an attacker to redirect authentication responses to a malicious site, enabling credential theft. Patching or hardening the redirect validation mitigates the risk.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.

Impact

Confidentiality: attacker can obtain user credentials via phishing. Integrity: compromised accounts can be used to modify or delete data. Availability: potential for service disruption if attackers lock out legitimate users. Defenders should monitor authentication logs for unusual redirect patterns and enforce strict redirect validation.

Remediation

Apply the latest IBM API Connect patches (10.0.8.13 or later, 12.1.1.3 or later). If patching is delayed, configure the authentication service to whitelist redirect URLs or disable external redirects. Enable multi-factor authentication to reduce credential compromise impact. Monitor logs for failed login attempts and unexpected redirect URLs.

Risk context

Severity is critical with CVSS 9.6. No EPSS data available, but the high severity indicates urgent attention. Defenders should prioritize patching or mitigation immediately.

Affected products

• IBM API Connect 10.0.8
• IBM API Connect 12.1.0
• IBM API Connect 12.1.1