---
id: "CVE-2026-16720"
page: "https://infrastack.ai/live/CVE-2026-16720"
kind: "vulnerability"
aliases: ["CVE-2026-16720"]
title: "IBM API Connect: remote attacker can obtain other users' access tokens"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "API Connect", "fixed": ["10.0.8.13", "12.1.1.3"], "affected": ">= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-gateway", "ibm-api-connect", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-07T05:18:21+00:00"
first_seen_at: "2026-11-07T05:45:57+00:00"
updated_at: "2026-11-07T06:01:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16720", "first_seen_at": "2026-11-07T05:45:57+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/node/7295637", "first_seen_at": "2026-11-07T06:01:36+00:00", "cites": ["https://www.ibm.com/support/pages/node/7295637", "https://www.ibm.com/support/pages/node/7295635"]}]
exploit_sources: []
---

# IBM API Connect: remote attacker can obtain other users' access tokens

Link for people: https://infrastack.ai/live/CVE-2026-16720 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sufficiently enforce authentication against a connected directory service. A remote attacker can obtain valid access tokens for other users and assume their identity.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:API Connect affected >= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2 fixed 10.0.8.13, 12.1.1.3

## How to check

Check your API Connect version: affected are 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 (per the CVE record). The CVE text says the flaw is in authentication against a connected directory service, so also check whether your Management/API Manager sign-in uses an external directory (e.g. LDAP) user registry. IBM's bulletin does not say that is required for exposure or that other setups are safe, so treat any affected version as exposed until upgraded.

## Fix

Upgrade IBM API Connect 10.0.8.x to 10.0.8.13, and 12.1.x to 12.1.1.3 (IBM Fix Central). IBM lists no workaround.

## Timeline

- 2026-11-07T05:45:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16720
- 2026-11-07T06:01:36+00:00 analyst https://www.ibm.com/support/pages/node/7295637 — IBM bulletins 7295637 (10.0.8.13, lists CVE-2026-16720, no workarounds) and 7295635 (12.1.1.3). Fixed versions confirmed; directory-service requirement NOT stated by IBM, left unverified. No exploitation or PoC found; X/social not checked.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/node/7295637
- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/node/7295635

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_