CVE-2026-17291 in API Connect
Summary
by MITRE • 11/07/2026
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
The identified security flaw resides within IBM API Connect versions ranging from 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2, specifically affecting the OAuth 2.0 authentication flow. This vulnerability is classified as an open redirect issue that arises when the application fails to adequately validate the redirect URI parameter provided by the client during the authorization code grant process. In a standard OAuth 2.0 implementation, after a user successfully authenticates with the identity provider, the system redirects the browser back to the registered client application along with an authorization code or token. However, due to insufficient validation logic in these specific versions of IBM API Connect, an attacker can manipulate this redirect address to point toward a domain under their control rather than the legitimate callback URL associated with the trusted client application.
The technical mechanism behind this vulnerability exploits the lack of strict allow-listing or rigorous pattern matching for the state and redirect_uri parameters. When a remote authenticated user interacts with the compromised authentication endpoint, they can be tricked into initiating an OAuth flow where the final redirection target is specified by the attacker. Because the server trusts the input without verifying that it matches one of the pre-registered safe endpoints, the resulting access token or authorization code is transmitted to the malicious site via URL fragments or query parameters depending on the browser's handling of redirects and cross-origin restrictions. This behavior effectively bypasses the security boundary intended by OAuth 2.0, allowing sensitive authentication credentials to leak outside the trusted environment.
The operational impact of this vulnerability is severe, primarily facilitating account takeover attacks against users who have authenticated through IBM API Connect. Once an attacker captures the authorization code or token at their controlled endpoint, they can exchange it for valid access tokens associated with the victim's session. This grants the attacker unauthorized access to the user's resources and data protected by the API gateway. Furthermore, this vulnerability undermines the integrity of single sign-on implementations that rely on IBM API Connect as an identity provider. The ability to intercept authentication results means that any service relying on these tokens for authorization becomes compromised, potentially leading to data exfiltration, privilege escalation within connected systems, or further lateral movement in a networked environment where trust is established via these intercepted credentials.
This flaw aligns with Common Weakness Enumeration identifier CWE-601, which describes URL Redirection to Untrusted Site, and maps directly to the ATT&CK technique T1534, known as Internal Spearphishing or Phishing for Information through Redirects. The vulnerability represents a classic implementation error where developer assumptions about user behavior lead to security failures in critical authentication pathways. To mitigate this risk, organizations must ensure that IBM API Connect is updated to versions beyond 10.0.8.12 and 12.1.1.2, which contain patches for this specific validation logic. In the interim, administrators should enforce strict allow-listing of redirect URIs at the application level rather than relying solely on server-side defaults if possible, and monitor logs for unusual patterns in OAuth callback requests that deviate from expected client configurations.