External risk intelligence

IBM API Connect Open Redirect Vulnerability Allows Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-17291

IBM API Connect is an enterprise API management solution designed to be public-facing to facilitate API traffic and OAuth authentication flows. Because this vulnerability exists within the OAuth 2.0 sign-in process, it directly affects a service that is typically exposed to the internet by design to handle external user and application authentication.

Ibm Api Connect

10.0.8.0 to before 10.0.8.1312.1.0.0 to before 12.1.1.3

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects IBM API Connect, an enterprise API management solution. It could allow an authenticated attacker to take over user accounts by exploiting a weakness in the sign-in process, potentially leading to unauthorized access.

Open redirect flaw can lead to account takeover.
Affects public-facing API authentication services.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by tricking an authenticated user into clicking a crafted link. This link, designed to manipulate the OAuth 2.0 sign-in process, redirects the user to a malicious site. If successful, this could lead to the attacker taking over the user's account.

Requires authenticated access.
Triggered by user interaction with a crafted link.
Enables account takeover.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker with legitimate credentials could potentially redirect authenticated users to a malicious site, leading to account takeover. This occurs when the redirect address used during OAuth 2.0 sign-in is not properly validated, allowing sensitive authentication information to be sent to an attacker-controlled location.

User account access.
Malicious redirect of authentication.
Compromised user accounts.

Operational Fix

Recommended remediation, mitigation, and detection steps

The IBM API Connect platform, typically exposed externally for API management and authentication, is susceptible to account takeover via an open redirect in its OAuth 2.0 sign-in flow. Platform or application owners are likely responsible for addressing this, with the first practical step being to identify all instances of the affected product, confirm their external reachability and business criticality, and then meticulously plan remediation around identified owners and risk levels.

Platform or application owners should lead remediation.
Verify external exposure and business criticality first.
Plan remediation based on identified ownership and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM API Connect?

IBM API Connect is an enterprise-grade platform used to create, manage, secure, and monitor application programming interfaces. Organizations use it to handle API traffic and manage the authentication processes—such as OAuth 2.0—that allow developers and applications to safely access their services.

What does this CVE mean regarding an open redirect?

This vulnerability, classified as CWE-601 (Open Redirect), means the software fails to verify where it sends users after they log in. In the context of CVE-2026-17291, an attacker can manipulate the sign-in process so that after a user authenticates, the system directs them to a malicious site instead of the intended destination.

How is this vulnerability triggered?

An attacker triggers this by tricking a logged-in user into interacting with a specifically crafted link that subverts the OAuth 2.0 flow. It is important to note that this does not occur through automated background scanning; it requires active manipulation of the authentication process and user interaction to redirect the login result to an attacker-controlled location.

Is my system at risk?

Halo Surface Signal indicates that IBM API Connect is often intentionally public-facing to handle external traffic and authentication. If your instance is exposed to the internet, it is a primary target for this type of attack. You should prioritize assessing systems that provide public-facing authentication gateways.

What should I do to respond to CVE-2026-17291?

Start by identifying every instance of IBM API Connect in your environment and cataloging the teams responsible for them. Once you have a clear inventory, assess the business criticality and internet exposure of each instance to prioritize your remediation efforts and coordinate with the relevant application owners.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.