Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-11-07T05:18:36.097Z",
  "pubdate": "2026-11-07T05:18:36.097Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to an open redirect vulnerability during the OAuth 2.0 sign-in process. This security flaw stems from insufficient validation of the redirect URI parameters utilized during the authentication workflow.\nA remote authenticated attacker can leverage this vulnerability to perform an account takeover by manipulating the redirect address. By crafting a malicious request that forces the application to redirect the user to an attacker-controlled destination, the authentication response, including sensitive tokens or authorization codes, can be exfiltrated. This compromise bypasses standard authentication security boundaries, posing a significant risk to user data integrity and session security. The vulnerability requires the attacker to be authenticated to initiate the OAuth flow, though the exploitation target is typically another user or the session integrity of the system itself. Organizations utilizing the affected versions should prioritize hardening their OAuth configurations and applying relevant security updates as they become available to mitigate the risk of unauthorized session access and credential interception.",
  "technicalDetails": "The vulnerability resides within the OAuth 2.0 implementation of IBM API Connect, specifically in how the application processes and validates the 'redirect_uri' parameter during the authentication and authorization handshake. The root cause is a failure to implement a robust allowlist or strict validation mechanism for the redirect URI, allowing an attacker to inject arbitrary destinations into the redirection logic.\nThe exploitation flow begins when an attacker, who must be authenticated to the target environment, initiates an OAuth 2.0 sign-in request. The attacker modifies the redirect parameter to point to an external malicious server controlled by the adversary. When the target user or system proceeds with the authentication process, the authorization server processes the request and subsequently issues an authorization code or access token. Due to the lack of validation, the application transmits these sensitive authentication artifacts to the attacker's specified URI.\nOnce the authorization code or token is captured at the malicious endpoint, the attacker can leverage these credentials to impersonate the victim, effectively facilitating an account takeover. This action allows the attacker to assume the identity of the authenticated user, gain access to protected API resources, or perform unauthorized administrative operations depending on the scope and permissions associated with the compromised token.\nThe scope of this vulnerability encompasses versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 of IBM API Connect. The attack is inherently remote, exploiting the network-accessible OAuth endpoints exposed by the product. Because the redirect validation is performed server-side, the client-side environment is largely irrelevant to the success of the exploitation. The primary technical constraint is the requirement for the attacker to successfully manipulate the redirect logic at the protocol level, which effectively turns the legitimate OAuth flow into a vehicle for token exfiltration. The post-exploitation impact is severe, as it grants the adversary an authenticated session context, which is typically trusted by the backend services, leading to potential data breaches, unauthorized data modification, or further lateral movement within the API ecosystem."
}