Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:35.867Z",
  "pubdate": "2026-11-07T05:18:35.867Z",
  "executiveSummary": "A critical vulnerability exists in IBM API Connect involving improper verification of cryptographic signatures during the identity provider handshake process. This flaw allows a remote authenticated attacker to bypass authentication security controls and manipulate identity data.\nThe vulnerability affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. By failing to fully validate the integrity of identity tokens provided by external login providers, the system inadvertently trusts forged identity payloads.\nSuccessful exploitation enables an attacker to create unauthorized user accounts with arbitrary privileges within the affected API Connect environment. This represents a significant risk to organizational identity management and access control policies, as an attacker can assume the identity of trusted users or create new, illegitimate administrative entities.\nThe attack requires that the attacker has authenticated access to the system, from which they can then interact with the identity provider integration points. The primary risk is the loss of user integrity and the potential for unauthorized privilege escalation, posing a severe threat to the security posture of the affected API ecosystem.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation logic within the authentication subsystem of IBM API Connect, specifically concerning the processing of identity information received from external login providers (e.g., OIDC or SAML-based providers).\nUnder normal operating conditions, the system is expected to perform strict cryptographic signature verification on identity assertions to ensure that the data originates from a legitimate, trusted identity provider. However, the implementation fails to enforce full verification of these signatures before processing the assertion.\nThe attack flow begins when an attacker, who possesses valid authentication to interact with the application’s login or identity federation interface, intercepts or crafts a malicious identity assertion payload. Because the application logic does not perform a robust, mandatory verification of the cryptographic signature attached to the identity provider data, the system treats the forged payload as authentic.\nBy injecting manipulated identity data—such as custom user attributes or identifiers—into the authentication exchange, the attacker can influence the account creation process. The application backend accepts the unverified assertion and proceeds to instantiate a new user account based on the contents of the forged payload.\nThis behavior bypasses the expected security gate that prevents arbitrary account creation. Because the identity provider's signature is either partially checked or ignored, the system lacks the cryptographic proof required to confirm that the user information provided has not been tampered with in transit or maliciously constructed.\nThe vulnerable component resides within the identity integration layer of the API Connect platform. The vulnerability is present across version ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The exploitation requires the attacker to be authenticated, meaning the attacker must be able to reach the authentication flow. Once the malicious payload is submitted, the impact is immediate: the creation of an unauthorized account that may subsequently be used for further lateral movement, API access, or data exfiltration, depending on the privileges assigned to the created account."
}