CVE-2026-16720

Summary

IBM API Connect fails to properly enforce authentication when integrating with external directory services, allowing an unauthenticated remote attacker to obtain valid access tokens for other users by impersonating them.

Exploitability

Exploitation requires no prior access or user interaction and is straightforward if the attacker can send authenticated requests to the token endpoint without proper identity binding to the directory service.

Blast radius

Successful exploitation enables full compromise of confidentiality, integrity, and availability for all API consumers relying on API Connect's authentication, potentially affecting thousands of users and backend systems.

Detection

Monitor for repeated token requests from the same source IP with varying or suspicious subject identifiers (e.g., non-existent usernames) in SAML or OAuth token responses; look for anomalous patterns in directory service bind attempts that lack proper credential validation.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.