Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-16720: IBM API Connect may let attackers steal other users' tokens
CVE-2026-16720 · published 1 day ago
Summary
Versions of IBM API Connect from 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2 can let a remote attacker obtain valid access tokens belonging to other users because the system does not enforce proper authentication against the directory service. This could allow the attacker to act as another user and access data or services they should not reach. Apply the latest IBM-released updates or patches and review authentication settings to ensure only authorized users can obtain tokens.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ibm | api connect | <= 12.1.1.2 |
Original advisory text
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-287Improper Authentication
Timeline
Published7 Nov 2026
Updated7 Nov 2026
First seen7 Nov 2026
Track software like this
Free during beta