{"id":"CVE-2026-17291","published":"2026-11-07T05:18:36.097","lastModified":"2026-11-11T05:19:40.093","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.","cvssScore":8.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-601"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains an open redirect vulnerability in its OAuth 2.0 sign-in flow, allowing an authenticated attacker to manipulate the redirect URL after authentication and receive the resulting tokens or session on an attacker-controlled domain, leading to account takeover.","exploitability":"Exploitation requires a valid authenticated session and user interaction (e.g., clicking a crafted link), with low attack complexity but limited to authenticated users.","blast_radius":"Successful exploitation enables full account takeover of any targeted user, potentially compromising sensitive APIs, data, and downstream systems accessible via the compromised account.","remediation":"Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 or later, as these versions include fixes for the open redirect vulnerability in the OAuth 2.0 sign-in flow.","detection":"Defenders should monitor OAuth authentication logs for unexpected redirect URLs pointing to external domains (especially non-whitelisted or suspicious TLDs) following successful login, and correlate with user activity anomalies such as token issuance to unfamiliar endpoints.","tags":["open-redirect","oauth","account-takeover","auth-bypass","web"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:55:20.507Z"}}