CVE-2026-116376 in Db2 Genius Hub
Summary
by MITRE • 11/04/2026
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The identified security flaw within IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 represents a critical web application vulnerability classified as an Open Redirect, which aligns with CWE-601 in the Common Weakness Enumeration standard. This specific type of weakness occurs when a web application accepts user-supplied input for redirection purposes but fails to properly validate or sanitize that input against a list of allowed domains or paths. Consequently, the application blindly redirects users to URLs provided by an attacker without verifying if those destinations are legitimate parts of the trusted domain space. In the context of IBM Db2 Genius Hub, this vulnerability allows a remote authenticated attacker to manipulate the redirection logic embedded within the application's interface or API endpoints.
The operational impact of this vulnerability is primarily centered around social engineering and phishing campaigns rather than direct system compromise or data exfiltration through traditional exploitation vectors like code injection. Because the redirect originates from a trusted domain associated with IBM Db2 Genius Hub, it carries significant weight in the eyes of end-users who perceive the link as safe and legitimate. An attacker can craft a malicious URL that points to an external phishing site mimicking sensitive interfaces or login portals for other services. When a victim clicks this crafted link while authenticated within the Genius Hub environment, they are seamlessly redirected away from the trusted application context without any warning indicators in their browser's address bar initially showing a different domain until after the redirect completes. This technique effectively bypasses user skepticism and increases the likelihood of credential theft or malware installation on the victim's device.
From an adversary perspective, this vulnerability facilitates techniques documented under MITRE ATT&CK framework categories such as T1566.002 Phishing: Spearphishing Link and potentially T1189 Drive-by Compromise if the landing page hosts malicious content. The authenticated nature of the required access means that only users with valid credentials can trigger this redirect, which may limit the scope but also ensures that the target is already within an enterprise environment where trust levels are higher. This makes the phishing attempt more convincing because it leverages the existing authentication session and the reputation of the IBM product to lower the victim's guard.
To mitigate this vulnerability, organizations should ensure they have applied all available security patches provided by IBM for Db2 Genius Hub versions 1.1.2 through 1.1.5 immediately upon release. From a development perspective, remediation requires implementing strict allow-listing mechanisms where only predefined, safe domains and paths are permitted for redirection logic. Input validation should be enforced on the server side to reject any redirect parameters that do not match expected patterns or originate from whitelisted sources. Additionally, security awareness training for users is recommended to recognize subtle changes in URLs during redirects, although technical controls remain the primary defense against this class of vulnerability.