CVE-2026-17291

Summary

IBM API Connect contains an open redirect vulnerability in its OAuth 2.0 sign-in flow, allowing an authenticated attacker to manipulate the redirect URL after authentication and receive the resulting tokens or session on an attacker-controlled domain, leading to account takeover.

Exploitability

Exploitation requires a valid authenticated session and user interaction (e.g., clicking a crafted link), with low attack complexity but limited to authenticated users.

Blast radius

Successful exploitation enables full account takeover of any targeted user, potentially compromising sensitive APIs, data, and downstream systems accessible via the compromised account.

Detection

Defenders should monitor OAuth authentication logs for unexpected redirect URLs pointing to external domains (especially non-whitelisted or suspicious TLDs) following successful login, and correlate with user activity anomalies such as token issuance to unfamiliar endpoints.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 or later, as these versions include fixes for the open redirect vulnerability in the OAuth 2.0 sign-in flow.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.