{"id":"CVE-2026-105459","kind":"vulnerability","aliases":["CVE-2026-105459"],"related":[],"title":"IBM API Connect: token signature flaw lets attackers join organizations without invitation","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation.","summary":"IBM API Connect accepts a token without fully verifying its cryptographic signature in affected 10.0.8.x and 12.1.x releases. An attacker can use this to join an organization without a valid invitation.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-connect","ibm","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2","fix":null,"status":"open","published_at":"2026-11-07T05:18:00+00:00","first_seen_at":"2026-11-07T05:45:56+00:00","triaged_at":"2026-11-07T05:52:27+00:00","updated_at":"2026-11-07T05:52:27+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:52:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM API Connect: token signature flaw lets attackers join organizations without invitation","impact":"medium","summary":"IBM API Connect accepts a token without fully verifying its cryptographic signature in affected 10.0.8.x and 12.1.x releases. An attacker can use this to join an organization without a valid invitation.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker joins organization without invitation and gains unauthorized access","analyst_note":"Confirm the fixed versions and any required setting from IBM's security bulletin for CVE-2026-105459; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are exposed. The sources do not say which deployment configurations are affected beyond the version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4264,"output_tokens":536,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105459':15A,18A '-2026':14A,17A '10.0.8':41B '10.0.8.0':63C '10.0.8.12':65C '12.1':44B '12.1.0.0':67C '12.1.1.2':69C 'accept':30B,92C 'access':77C 'affect':40B 'allow':71C,101C 'api':2A,20B,28B,61C 'api-connect':19B 'attack':8A,48B,73C,103C 'connect':3A,21B,29B,62C 'could':70C,100C 'cryptograph':37B,87C 'cve':13A,16A 'due':81C 'flaw':6A 'fulli':34B,97C 'gain':75C 'host':25B 'ibm':1A,22B,27B,60C 'improp':83C 'invit':12A,59B,111C 'join':9A,53B,105C 'let':7A 'organ':10A,55B,80C,107C 'releas':46B 'self':24B 'self-host':23B 'signatur':5A,38B,88C,95C 'token':4A,32B,90C 'unauthor':76C 'use':50B 'valid':58B,110C 'vendor':26B 'verif':84C 'verifi':35B,98C 'without':11A,33B,56B,93C,108C 'x':42B,45B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are exposed. The sources do not say which deployment configurations are affected beyond the version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apiconnect","ibm","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-105459':15A,18A '-2026':14A,17A 'api':2A 'attack':8A 'connect':3A 'cve':13A,16A 'flaw':6A 'ibm':1A 'invit':12A 'join':9A 'let':7A 'organ':10A 'signatur':5A 'token':4A 'without':11A","search_b":"'10.0.8':41B '12.1':44B 'accept':30B 'affect':40B 'api':20B,28B 'api-connect':19B 'attack':48B 'connect':21B,29B 'cryptograph':37B 'fulli':34B 'host':25B 'ibm':22B,27B 'invit':59B 'join':53B 'organ':55B 'releas':46B 'self':24B 'self-host':23B 'signatur':38B 'token':32B 'use':50B 'valid':58B 'vendor':26B 'verifi':35B 'without':33B,56B 'x':42B,45B","search_c":"'10.0.8.0':63C '10.0.8.12':65C '12.1.0.0':67C '12.1.1.2':69C 'accept':92C 'access':77C 'allow':71C,101C 'api':61C 'attack':73C,103C 'connect':62C 'could':70C,100C 'cryptograph':87C 'due':81C 'fulli':97C 'gain':75C 'ibm':60C 'improp':83C 'invit':111C 'join':105C 'organ':80C,107C 'signatur':88C,95C 'token':90C 'unauthor':76C 'valid':110C 'verif':84C 'verifi':98C 'without':93C,108C","first_public_at":"2026-11-07T05:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105459","severity":null,"published_at":"2026-11-07T05:18:00+00:00","modified_at":"2026-11-07T05:18:00+00:00","first_seen_at":"2026-11-07T05:45:56+00:00","fetched_at":"2026-11-07T05:45:56+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}