Advisory · CVE-2026-16720
IBM API Connect authentication flaw lets attackers steal other users access tokens
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 does not sufficiently enforce authentication against a connected directory service, letting a remote attacker obtain valid access tokens for other users and assume their identity, rated critical at CVSS 9.8.
- Vendor
- IBM
- Product
- API Connect
- Identifier / CWE
- CVE-2026-16720
CWE-287 - Action timing
- Immediate
Explain it like I’m five
API Connect is supposed to check your badge against the company directory before handing you a token. The check is not enforced, so an attacker can collect tokens that belong to other people and walk in as them.
- 01Directory check skipped
Authentication against the connected directory service is not sufficiently enforced on affected API Connect releases.
- 02Token request crafted
A remote attacker sends a request that exploits the weak authentication check.
- 03Another users token issued
The attacker obtains a valid access token belonging to another user.
- 04Identity assumed
The attacker uses the token to act as that user against APIs and management functions.
What happened
IBM disclosed CVE-2026-16720 as part of a multi-vulnerability API Connect bulletin: API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user’s identity to be assumed. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, and no privileges required.
This is one of about 98 CVEs in the same IBM API Connect bulletin; this advisory covers only this CVE. The bulletin text read for this run does not state a fixed release version, so none is claimed here. The practical impact is identity theft inside an API platform: a stolen token is indistinguishable from the legitimate user until it is revoked.
What to do
- Inventory IBM API Connect deployments and record each version, including management, gateway, and analytics components.
- Apply the fix from IBM’s security bulletin for the affected release lines.
- Until patched, restrict network access to the API Connect management and gateway interfaces and treat them as untrusted-input surfaces.
- Review access and audit logs for token use by unexpected users, unexpected administrative operations, and requests to internal or metadata addresses.
- Rotate API keys, tokens, and credentials if misuse or unauthorized access cannot be excluded.
- Verify the deployed version after updating.
Management note
A token that belongs to someone else is a skeleton key for everything that user can reach. Patch, then treat every token issued while the flaw was live as suspect until the logs say otherwise.