A critical open redirect flaw in IBM API Connect's sign-in flow could let a remote attacker send authentication results to a location they control. That could lead to account takeover.
What Is It
CVE-2026-17297 is an open redirect vulnerability (CWE-601) in IBM API Connect. According to the NVD record, the redirect address used during sign-in is not properly validated. A remote attacker could abuse this to have authentication results sent to an attacker-controlled location, which could lead to account takeover.
IBM's PSIRT published the record on 2026-11-07. NVD lists its status as "Awaiting Analysis."
Why It Matters
IBM rates the flaw 9.6 (CRITICAL) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. In plain terms:
- Network-reachable, with low attack complexity
- No privileges required
- User interaction required: a victim must take part, for example by following a crafted sign-in link
- Scope changed, with high impact to confidentiality, integrity and availability
The "scope changed" rating means IBM judges that a successful attack can affect resources beyond the vulnerable component itself. The advisory data does not say what an attacker could reach after taking over an account. The user-interaction requirement lowers exploitability (exploitability subscore 2.8), but phishing-style delivery of crafted redirect links is a common way to meet it.
The supplied data contains no CISA KEV entry for this CVE. Active exploitation is not confirmed by KEV at the time of writing.
What's Vulnerable
The following IBM API Connect versions are affected:
| Branch | Affected Versions |
|---|---|
| 10.0.8.x | 10.0.8.0 through 10.0.8.12 |
| 12.1.x | 12.1.0.0 through 12.1.1.2 |
Organizations running any release in these ranges should treat their deployments as exposed.
Patch Status
The NVD record does not list fixed versions or specific remediation steps. IBM has published two support bulletins for this issue (linked below). Administrators should:
- Review the IBM bulletins for fixed releases and any interim mitigations
- Inventory API Connect instances against the affected version ranges
- Prioritize upgrades given the critical severity rating
There is no CISA KEV entry, so no federal remediation deadline or required action applies at this time.