IBM Engineering AI Hub EUVD-2026-45299

The victim must click an attacker-crafted link containing a malicious redirect target URL parameter (UI:R) - automated exploitation without user interaction is not possible. The CVSS vector confirms PR:N, meaning the attacker requires no account or session on the IBM Engineering AI Hub instance itself. No special server-side feature flag, non-default configuration, or specific deployment mode is required; the vulnerability is present in default installations of IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0. Exploitation is limited to social-engineering scenarios (phishing, watering hole) and cannot result in direct server compromise, data exfiltration from the application, or availability disruption - the attacker's gain is a trusted-domain hop URL.

The NVD-assigned CVSS 3.1 base score of 4.3 (Medium) reflects the constrained impact: AV:N (network-reachable), AC:L (low complexity to craft), PR:N (no server privileges needed), UI:R (victim interaction required), S:U (no scope change), C:L (limited confidentiality impact), I:N, A:N. The UI:R requirement meaningfully limits automated or opportunistic exploitation - mass scanning cannot trigger this flaw; a social engineering step is mandatory. No EPSS score was provided in the available data, and the absence of a KEV listing indicates no confirmed active exploitation at this time. No POC exploit code has been publicly identified. Real-world risk is primarily reputational and phishing-facilitation: attackers gain a trusted IBM-branded hop URL to increase victim confidence, but cannot directly compromise the server or exfiltrate data from the application itself. This is a genuine Medium - not inflated by theoretical impact - and should be prioritized for patching on a normal cycle rather than emergency response.

An attacker identifies a redirect endpoint in the target organization's IBM Engineering AI Hub deployment and constructs a URL such as https://aihub.corp.example.com/redirect?next=https://attacker-phishing.com/harvest. The attacker delivers this URL via a spear-phishing email impersonating an IBM or internal IT notification; the victim, trusting the corporate domain in the link, clicks it and is transparently forwarded to the attacker's credential-harvesting page. No public exploit code has been identified at time of analysis, but this attack pattern requires no technical tooling beyond URL construction.