{"id":"CVE-2026-17290","published":"2026-11-07T05:18:35.867","lastModified":"2026-11-10T16:26:01.830","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","cwes":["CWE-290"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 fail to fully verify cryptographic signatures on identity assertions from login providers, allowing authenticated attackers to forge identity data and create unauthorized user accounts via improper signature validation (CWE-290).","exploitability":"Exploitation requires valid authentication as a low-privilege user and the ability to submit forged identity tokens without proper signature verification.","blast_radius":"Successful exploitation enables privilege escalation by allowing attackers to create new accounts with arbitrary identities, potentially gaining unauthorized access to resources or data.","remediation":"Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3, where the cryptographic signature verification flaw has been addressed.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","signature-forgery","privilege-escalation","ibm","api-connect"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:49:40.776Z"}}