{"id":"CVE-2026-17297","kind":"vulnerability","aliases":["CVE-2026-17297"],"related":[],"title":"IBM API Connect: open redirect during sign-in enables account takeover","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate the redirect address used during sign-in. An attacker can send authentication results to a location they control, which leads to account takeover.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"Check the installed API Connect version. Affected: 10.0.8.0 through 10.0.8.12 (fixed in 10.0.8.13) and 12.1.0.0 through 12.1.1.2 (fixed in 12.1.1.3). The 10.0.8.13 bulletin's metadata says V10.0.8.0 - V10.0.8.13, but its table and fix say 10.0.8.12 is the last affected.","fix":"Upgrade API Connect 10.0.8.x to 10.0.8.13, or 12.1.x to 12.1.1.3 (IBM Fix Central). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:37+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:48:31+00:00","updated_at":"2026-11-07T05:56:26+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: open redirect during sign-in enables account takeover","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate the redirect address used during sign-in. An attacker can send authentication results to a location they control, which leads to account takeover.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker takes over user accounts via redirected sign-in results","analyst_note":"Check the IBM security bulletin for API Connect for the fixed versions and whether the victim must click a crafted link.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say which configuration or endpoint is involved.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed to sign-in redirect abuse. The sources do not say which deployment settings or sign-in flows are required, so whether a given instance is reachable this way is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000698,"input_tokens":4268,"output_tokens":542,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for API Connect for the fixed versions and whether the victim must click a crafted link.","search":"'-17297':15A,18A '-2026':14A,17A '10.0.8.0':39B,76C '10.0.8.12':41B,78C '12.1.0.0':43B,80C '12.1.1.2':45B,82C 'account':11A,71B,91C 'address':51B,101C 'allow':84C,113C 'api':2A,20A,23A,29B,36B,74C 'attack':58B,87C,122C 'attacker-control':121C 'authent':61B,114C 'connect':3A,21A,24A,30B,37B,75C 'control':67B,123C 'could':83C,112C 'cve':13A,16A 'due':93C 'enabl':10A 'host':33B 'ibm':1A,19A,22A,28B,35B,73C 'ibm-api-connect':27B 'lead':69B 'locat':65B,124C 'onprem':26A 'open':4A,96C 'perform':89C 'redirect':5A,50B,97C,100C 'remot':86C 'result':62B,115C 'self':32B 'self-host':31B 'send':60B 'sent':118C 'sign':8A,55B,105C 'sign-in':7A,54B,104C 'suffici':109C 'takeov':12A,72B,92C 'use':52B,102C 'v12':25A 'valid':48B,110C 'vendor':34B 'version':38B 'vulner':98C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2 (v12 OnPrem). The attacker needs no account, but the CVSS vector requires user interaction, so a user likely has to follow a crafted sign-in link; IBM does not describe the exact flow. Teams on 10.0.8.13 or 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:56:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1983},"products":{"at":"2026-11-07T05:56:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1983},"mitigations":{"at":"2026-11-07T05:56:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1983},"workarounds":{"at":"2026-11-07T05:56:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1983},"how_to_check":{"at":"2026-11-07T05:56:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1983}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","ibmapiconnect","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17297':15A,18A '-2026':14A,17A 'account':11A 'api':2A,20A,23A 'connect':3A,21A,24A 'cve':13A,16A 'enabl':10A 'ibm':1A,19A,22A 'onprem':26A 'open':4A 'redirect':5A 'sign':8A 'sign-in':7A 'takeov':12A 'v12':25A","search_b":"'10.0.8.0':39B '10.0.8.12':41B '12.1.0.0':43B '12.1.1.2':45B 'account':71B 'address':51B 'api':29B,36B 'attack':58B 'authent':61B 'connect':30B,37B 'control':67B 'host':33B 'ibm':28B,35B 'ibm-api-connect':27B 'lead':69B 'locat':65B 'redirect':50B 'result':62B 'self':32B 'self-host':31B 'send':60B 'sign':55B 'sign-in':54B 'takeov':72B 'use':52B 'valid':48B 'vendor':34B 'version':38B","search_c":"'10.0.8.0':76C '10.0.8.12':78C '12.1.0.0':80C '12.1.1.2':82C 'account':91C 'address':101C 'allow':84C,113C 'api':74C 'attack':87C,122C 'attacker-control':121C 'authent':114C 'connect':75C 'control':123C 'could':83C,112C 'due':93C 'ibm':73C 'locat':124C 'open':96C 'perform':89C 'redirect':97C,100C 'remot':86C 'result':115C 'sent':118C 'sign':105C 'sign-in':104C 'suffici':109C 'takeov':92C 'use':102C 'valid':110C 'vulner':98C","first_public_at":"2026-11-07T05:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17297","severity":null,"published_at":"2026-11-07T05:18:37+00:00","modified_at":"2026-11-07T05:18:37+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17297:1983","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:56:26+00:00","modified_at":"2026-11-07T05:56:26+00:00","first_seen_at":"2026-11-07T05:56:26+00:00","fetched_at":"2026-11-07T05:56:26+00:00","note":"Read both IBM bulletins (api-connect-39 for 12.1.x, api-connect-41 for 10.0.8.x); fixes 12.1.1.3 and 10.0.8.13, no workarounds. Bulletin does not say whether victim must click (CVSS UI:R implies user interaction). No exploitation seen; X not searched.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}