Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-11-07T05:18:37.333Z",
  "pubdate": "2026-11-07T05:18:37.333Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to an open redirect vulnerability during the authentication sign-in process.\nThis flaw originates from insufficient validation of redirect parameters, allowing an attacker to manipulate the target destination following a successful sign-in.\nThe primary risk associated with this vulnerability is account takeover, as authentication results or sensitive tokens may be inadvertently transmitted to an attacker-controlled endpoint.\nThe vulnerability is exploitable by a remote, unauthenticated attacker who can influence the authentication flow by providing a crafted URL.\nThe impact is significant, as it facilitates credential interception and unauthorized access to user sessions, compromising the security of the API management platform.\nSuccessful exploitation requires the victim to click on a maliciously crafted link, after which the application redirects them to the attacker's site rather than the intended legitimate resource.",
  "technicalDetails": "The vulnerability manifests within the authentication module of IBM API Connect, where the sign-in redirect logic fails to properly sanitize or validate the target URI supplied in a redirect parameter.\nRoot Cause Analysis: The application does not maintain a strict whitelist of allowed redirect domains or paths. Instead, it accepts user-supplied input to determine the post-authentication landing page. When the redirect parameter is insufficiently validated, it permits the injection of external, attacker-controlled URLs into the redirect handler.\nAttack Flow: An attacker crafts a malicious URL containing an authenticated sign-in request for the vulnerable IBM API Connect instance. This URL includes a modified redirect parameter pointing to a malicious server under the attacker's control. The attacker social-engineers a victim into initiating the sign-in process via this crafted link. Upon the victim providing valid credentials and completing the authentication handshake, the server processes the redirect instruction using the malicious, unvalidated URI. The authentication process concludes by sending the sensitive authentication token, session identifier, or proof of authentication to the attacker's external host instead of the expected internal application interface.\nExploitation Requirements: The exploit requires the victim to be tricked into visiting the crafted URL while the application is in an active authentication state. No specific privileges are required on the part of the attacker, as the vulnerability is inherent to the entry-point validation logic of the authentication sequence.\nPost-Exploitation Impact: Once the attacker captures the authentication results, they can leverage the intercepted tokens or session state to hijack the user's session. This grants the attacker unauthorized access to the victim's account within IBM API Connect, potentially allowing the modification of API configurations, viewing sensitive keys, or bypassing security controls enforced by the platform. The lack of domain validation ensures that any remote server can serve as the destination, effectively masking the malicious redirection from the end-user during the transition.\nThe affected versions include IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability exists within the logic responsible for handling session redirection after the completion of an identity provider interaction."
}