CVE-2026-15412: IBM WebSphere Open Redirect Vulnerability

CVE-2026-15412 Overview

CVE-2026-15412 is an open redirect vulnerability [CWE-601] affecting IBM WebSphere Application Server 9.0, 8.5, and IBM WebSphere Application Server Liberty. A remote attacker can craft a URL that appears to originate from a trusted WebSphere host but redirects victims to an attacker-controlled site. The flaw enables phishing campaigns that abuse the trust associated with legitimate WebSphere-hosted applications. Successful exploitation can lead to credential theft, session compromise, or delivery of secondary payloads. The vulnerability requires user interaction through a crafted link and does not require authentication on the target server.

Critical Impact
Attackers can weaponize trusted WebSphere URLs to redirect users to malicious sites, enabling phishing and credential harvesting against enterprise users.

Affected Products

IBM WebSphere Application Server 9.0
IBM WebSphere Application Server 8.5
IBM WebSphere Application Server Liberty

Discovery Timeline

2026-09-14 - CVE-2026-15412 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-15412

Vulnerability Analysis

CVE-2026-15412 is a URL Redirection to Untrusted Site vulnerability [CWE-601] in IBM WebSphere Application Server. The server accepts a user-supplied parameter that controls a redirect target without validating whether the destination points to an approved host. An attacker distributes a link that references a legitimate WebSphere endpoint but includes a redirect parameter pointing to a malicious domain. The victim's browser first contacts the trusted WebSphere host, then follows the server-issued redirect to the attacker's site. Because the initial URL and TLS certificate belong to a trusted domain, users and email security tools are less likely to flag the link.

Root Cause

The vulnerability stems from missing or insufficient validation of a redirect target parameter within WebSphere Application Server request handling. The application trusts client-supplied input when constructing an HTTP redirect response. No allowlist of permitted destination hosts is enforced before the redirect is issued.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker sends a phishing email, chat message, or malicious advertisement containing a crafted link that references the vulnerable WebSphere host. When the victim clicks the link, WebSphere issues an HTTP redirect that forwards the browser to an attacker-controlled landing page, typically a spoofed login portal.

No verified exploit code is publicly available. See the IBM Support Documentation for vendor-provided technical details.

Detection Methods for CVE-2026-15412

Indicators of Compromise

HTTP 302 or 303 responses issued by WebSphere hosts with Location headers pointing to external, non-corporate domains.
Inbound requests containing suspicious redirect parameters such as url=, redirect=, next=, or returnUrl= with fully qualified external URLs.
Outbound proxy logs showing users navigating from a trusted WebSphere URL directly to newly registered or low-reputation domains.

Detection Strategies

Inspect WebSphere access logs for redirect responses where the Location header host does not match the server hostname or a defined allowlist.
Correlate email gateway telemetry with web proxy logs to identify clicked links that traverse a WebSphere host before landing on an unknown external domain.
Deploy web application firewall (WAF) rules that flag requests containing absolute URLs in redirect-related query parameters.

Monitoring Recommendations

Enable verbose HTTP access logging on all WebSphere Application Server and Liberty instances, capturing full query strings and response Location headers.
Forward WebSphere and proxy logs to a centralized analytics platform for correlation against threat intelligence feeds covering phishing infrastructure.
Alert on spikes in redirect responses from WebSphere endpoints, which may indicate an active phishing campaign leveraging the flaw.

How to Mitigate CVE-2026-15412

Immediate Actions Required

Apply the IBM interim fix or fix pack referenced in the IBM Support Documentation to affected WebSphere 9.0, 8.5, and Liberty deployments.
Inventory internet-exposed WebSphere hosts and prioritize patching for those reachable from untrusted networks.
Notify users and SOC analysts to treat WebSphere-hosted links with additional scrutiny until patches are deployed.

Patch Information

IBM has published remediation guidance and fix availability in the IBM Support Documentation. Administrators should identify the applicable interim fix for their WebSphere version and apply it following IBM's standard update procedures.

Workarounds

Configure a reverse proxy or WAF in front of WebSphere to strip or block requests containing external URLs in redirect parameters.
Enforce an allowlist of permitted redirect destinations at the application or proxy layer.
Educate users to hover over links and verify final destinations, and to report unexpected redirects from internal WebSphere URLs.

bash

# Example ModSecurity rule to block external redirects in query parameters
SecRule ARGS_NAMES "@rx (?i)(url|redirect|redir|next|returnUrl|target)" \
  "chain,id:1015412,phase:2,deny,status:403,\
   msg:'Potential open redirect exploitation attempt (CVE-2026-15412)'"
  SecRule ARGS "@rx ^https?://(?!trusted\.example\.com)" "t:none"