A critical improper authentication flaw (CVSS 9.8) in IBM API Connect could let a remote, unauthenticated attacker get valid access tokens belonging to other users.
What Is It
CVE-2026-16720 is an improper authentication vulnerability (CWE-287) in IBM API Connect. According to the NVD record, published November 7, 2026 from IBM PSIRT data, the product does not properly enforce authentication against a connected directory service. Because of this, a remote attacker could obtain valid access tokens for other users and act as them.
The NVD status is currently "Awaiting Analysis." IBM, as the CVE numbering authority, has scored it as follows:
- CVSS 3.1 base score: 9.8 (CRITICAL)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Exploitability score: 3.9
- Impact score: 5.9
Why It Matters
The CVSS vector puts this flaw close to the worst case. It can be exploited over the network, attack complexity is low, and no privileges or user interaction are needed. A successful attack would have high impact on confidentiality, integrity and availability.
API Connect is an API management platform, so a stolen identity there could give an attacker whatever access the impersonated user has. In practice, that could mean legitimate tokens issued to the wrong person.
No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE. Active exploitation is not confirmed by KEV at this time, and no KEV remediation deadline applies.
What's Vulnerable
IBM lists these IBM API Connect versions as affected:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
The risk centers on deployments that authenticate against a connected directory service, since the flaw is in how that authentication is enforced.
Patch Status
IBM PSIRT has published two support advisories for this vulnerability, listed below. The supplied NVD data does not name fixed versions or workarounds. Administrators should check the IBM advisories for remediation guidance and fixed releases, and should prioritize affected API Connect instances given the critical severity and the lack of any authentication requirement.
Until a fix is applied, review access logs and token issuance on affected instances for signs of unexpected identity use.