IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw that allows a crafted authentication token to bypass full cryptographic signature verification. This issue is an instance of incorrect cryptographic verification (CWE-347). The flaw could permit an attacker to join an organization without a valid invitation, thus gaining unauthorized access. The description directly states that an attacker could join an organization; no explicit statement about confidentiality or integrity impact is provided.

IBM API Connect is the impacted product, with affected releases ranging from 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vendor recommends upgrading to 12.1.1.3 or, for earlier 10.x releases, to 10.0.8.13. The fix addresses the signature verification logic that was previously inadequate.

The CVSS score of 6.8 indicates moderate severity. EPSS is not available and the vulnerability is not included in KEV. The description suggests the attack vector could be remote via a crafted token, allowing the attacker to join an organization without proper authorization. No availability impact is explicitly stated.