Advisory · CVE-2026-17297
IBM API Connect open redirect lets attackers take over accounts at sign-in
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 lets a remote attacker perform account takeover through an open redirect, because the redirect address used during sign-in is not validated and authentication results can be sent to an attacker-controlled location, rated critical at CVSS 9.6.
- Vendor
- IBM
- Product
- API Connect
- Identifier / CWE
- CVE-2026-17297
CWE-601 - Action timing
- Immediate
Explain it like I’m five
When you sign in, API Connect sends your login result to an address written on the form, but it never checks that address. An attacker can write their own address on the form, have your login result mailed to them, and walk in as you.
- 01Crafted sign-in link
A remote attacker crafts a sign-in link carrying an attacker-controlled redirect address.
- 02Victim signs in
A user follows the link and signs in normally, with user interaction required.
- 03Redirect not validated
API Connect does not sufficiently validate the redirect address used during sign-in.
- 04Auth result sent to attacker
The authentication result is sent to the attacker-controlled location, letting the attacker take over the account.
What happened
IBM disclosed CVE-2026-17297 as part of a multi-vulnerability API Connect bulletin: API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location. The record rates it critical at CVSS 9.6 under version 3.1, with network attack vector, low complexity, and user interaction required.
This is one of about 98 CVEs in the same IBM API Connect bulletin; this advisory covers only this CVE. The bulletin text read for this run does not state a fixed release version, so none is claimed here. The flaw needs a victim to click, but a sign-in link is the easiest click in an enterprise, and the prize is a full account.
What to do
- Inventory IBM API Connect deployments and record each version, including management, gateway, and analytics components.
- Apply the fix from IBM’s security bulletin for the affected release lines.
- Until patched, restrict network access to the API Connect management and gateway interfaces and treat them as untrusted-input surfaces.
- Review access and audit logs for token use by unexpected users, unexpected administrative operations, and requests to internal or metadata addresses.
- Rotate API keys, tokens, and credentials if misuse or unauthorized access cannot be excluded.
- Verify the deployed version after updating.
Management note
Account takeover at sign-in turns a phishing click into a platform account. Patch, then warn users about sign-in links and check for sessions that started from unexpected redirect targets.