{"id":"CVE-2026-17291","kind":"vulnerability","aliases":["CVE-2026-17291"],"related":[],"title":"IBM API Connect: open redirect in OAuth sign-in enables account takeover","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate the redirect address used during OAuth 2.0 sign-in. An authenticated remote attacker can send sign-in results to an attacker-controlled location, which leads to account takeover.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-api-connect","oauth","open-redirect","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"Check your installed API Connect version. Affected: 10.0.8.0 to 10.0.8.12, and 12.1.0.0 to 12.1.1.2 (IBM lists V12 OnPrem). Fixed: 10.0.8.13 and 12.1.1.3. Also check whether OAuth 2.0 sign-in is used on your deployment.","fix":"Upgrade to IBM API Connect 10.0.8.13 (10.0.8 line) or 12.1.1.3 (12.1 line). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:36+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:48:50+00:00","updated_at":"2026-11-07T06:21:03+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-07T05:48:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: open redirect in OAuth sign-in enables account takeover","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate the redirect address used during OAuth 2.0 sign-in. An authenticated remote attacker can send sign-in results to an attacker-controlled location, which leads to account takeover.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","oauth","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker takes over user accounts via redirected sign-in results","analyst_note":"Confirm the fixed version and any vendor advisory for IBM API Connect 10.0.8.x and 12.1.x; the NVD entry gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`\n- unknown whether other configuration changes the exposure","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where users sign in through OAuth 2.0. The sources do not say whether a specific configuration or deployment mode changes exposure. Teams on other versions are not listed as affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4279,"output_tokens":575,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor advisory for IBM API Connect 10.0.8.x and 12.1.x; the NVD entry gives no fix.","search":"'-17291':16A,19A '-2026':15A,18A '10.0.8.0':44B,88C '10.0.8.12':46B,90C '12.1.0.0':48B,92C '12.1.1.2':50B,94C '2.0':60B,117C 'account':12A,83B,103C 'address':56B,113C 'allow':96C,127C 'api':2A,21A,24A,30B,41B,86C 'attack':67B,77B,100C,136C 'attacker-control':76B,135C 'authent':65B,99C,128C 'connect':3A,22A,25A,31B,42B,87C 'control':78B,137C 'could':95C,126C 'cve':14A,17A 'due':105C 'enabl':11A 'host':38B 'ibm':1A,20A,23A,29B,40B,85C 'ibm-api-connect':28B 'lead':81B 'locat':79B,138C 'oauth':7A,32B,59B,116C 'onprem':27A 'open':4A,34B,108C 'open-redirect':33B 'perform':102C 'redirect':5A,35B,55B,109C,112C 'remot':66B,98C 'result':73B,129C 'self':37B 'self-host':36B 'send':69B 'sent':132C 'sign':9A,62B,71B,119C 'sign-in':8A,61B,70B,118C 'suffici':123C 'takeov':13A,84B,104C 'use':57B,114C 'v12':26A 'valid':53B,124C 'vendor':39B 'version':43B 'vulner':110C","nicknames":[],"mitigations":[],"who_affected":"Self-managed IBM API Connect installs on 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. The OAuth 2.0 sign-in redirect address is not validated, so a logged-in low-privilege attacker who gets a user to follow a crafted link can send that user's sign-in result to an attacker-controlled site and take over the account. Teams not running API Connect, or already on 10.0.8.13 / 12.1.1.3, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:21:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":2056},"products":{"at":"2026-11-07T06:21:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":2056},"workarounds":{"at":"2026-11-07T06:21:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":2056},"how_to_check":{"at":"2026-11-07T06:21:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":2056},"who_affected":{"at":"2026-11-07T06:21:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":2056}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","ibmapiconnect","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["high","ibmapiconnect","oauth","openredirect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17291':16A,19A '-2026':15A,18A 'account':12A 'api':2A,21A,24A 'connect':3A,22A,25A 'cve':14A,17A 'enabl':11A 'ibm':1A,20A,23A 'oauth':7A 'onprem':27A 'open':4A 'redirect':5A 'sign':9A 'sign-in':8A 'takeov':13A 'v12':26A","search_b":"'10.0.8.0':44B '10.0.8.12':46B '12.1.0.0':48B '12.1.1.2':50B '2.0':60B 'account':83B 'address':56B 'api':30B,41B 'attack':67B,77B 'attacker-control':76B 'authent':65B 'connect':31B,42B 'control':78B 'host':38B 'ibm':29B,40B 'ibm-api-connect':28B 'lead':81B 'locat':79B 'oauth':32B,59B 'open':34B 'open-redirect':33B 'redirect':35B,55B 'remot':66B 'result':73B 'self':37B 'self-host':36B 'send':69B 'sign':62B,71B 'sign-in':61B,70B 'takeov':84B 'use':57B 'valid':53B 'vendor':39B 'version':43B","search_c":"'10.0.8.0':88C '10.0.8.12':90C '12.1.0.0':92C '12.1.1.2':94C '2.0':117C 'account':103C 'address':113C 'allow':96C,127C 'api':86C 'attack':100C,136C 'attacker-control':135C 'authent':99C,128C 'connect':87C 'control':137C 'could':95C,126C 'due':105C 'ibm':85C 'locat':138C 'oauth':116C 'open':108C 'perform':102C 'redirect':109C,112C 'remot':98C 'result':129C 'sent':132C 'sign':119C 'sign-in':118C 'suffici':123C 'takeov':104C 'use':114C 'valid':124C 'vulner':110C","first_public_at":"2026-11-07T05:18:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17291","severity":null,"published_at":"2026-11-07T05:18:36+00:00","modified_at":"2026-11-07T05:18:36+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17291:2056","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:21:03+00:00","modified_at":"2026-11-07T06:21:03+00:00","first_seen_at":"2026-11-07T06:21:03+00:00","fetched_at":"2026-11-07T06:21:03+00:00","note":"IBM bulletins 7295635 (12.1.1.3) and 7295637 (10.0.8.13) list this CVE (CWE-601, CVSS 8.7, PR:L/UI:R); fix versions and 'no workarounds' read on IBM pages. Not exploited, no PoC seen; X not searched.","cites":["https://www.ibm.com/support/pages/node/7295635","https://www.ibm.com/support/pages/node/7295637","https://www.ibm.com/support/pages/node/7290205"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93155,"url":"https://www.ibm.com/support/pages/node/7290205","title":"IBM API Connect v12.1.1.3 is now available","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}