IBM API Connect: Unauthorized account creation vulnerability (CVE-2026-17290)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability related to the processing of identity information from external login providers. The system fails to fully verify the cryptographic signatures of incoming identity assertions, which permits an attacker to provide forged identity data to the application. Successful exploitation allows a remote authenticated attacker to create unauthorized user accounts within the environment.

Impact

An attacker can bypass identity provider validation logic to create arbitrary user accounts, potentially leading to unauthorized system access or privilege escalation within the context of the API Connect platform.

Recommendation

• Inventory all deployed IBM API Connect instances to identify those running vulnerable version ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).
• Consult the IBM product security portal for specific patches or configuration updates addressing CVE-2026-17290.
• Review administrative logs for suspicious user account creation events, specifically those originating from external authentication provider integrations.