CVE-2026-17290

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 fail to fully verify cryptographic signatures on identity assertions from login providers, allowing authenticated attackers to forge identity data and create unauthorized user accounts via improper signature validation (CWE-290).

Exploitability

Exploitation requires valid authentication as a low-privilege user and the ability to submit forged identity tokens without proper signature verification.

Blast radius

Successful exploitation enables privilege escalation by allowing attackers to create new accounts with arbitrary identities, potentially gaining unauthorized access to resources or data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3, where the cryptographic signature verification flaw has been addressed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.