API CONNECT · CVE-2026-16720 · Vendor
FIX → 12.1.1.3 · 10.0.8.13 ✓ verified
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sufficiently enforce authentication against a connected directory service. A remote attacker can obtain valid access tokens for other users and assume their identity.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted IBM API Connect 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. IBM rates it 9.8 (network, no authentication, no user interaction): a remote attacker can obtain valid access tokens of other users and assume their identity. The flaw concerns authentication against a connected directory service; IBM does not state whether deployments without one are unaffected. Teams already on 10.0.8.13 or 12.1.1.3 can skip it.
Not affected if unknown
Who cares api-gateway, ibm-api-connect, self-hosted
10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 (per the CVE record)IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 12.1.1.3 · 10.0.8.13
10.0.8.x to 10.0.8.13, and 12.1.x to 12.1.1.3 (IBM Fix Central)