IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw in token validation where an improperly implemented security check (CWE-358, Improper Authorization) can allow a token to be accepted that should have been rejected. This weakness permits an attacker to use a token for a purpose it was not intended for, potentially granting unauthorized access, exposing sensitive data, or enabling further malicious activity.

The vulnerable products are IBM API Connect from IBM. Affected releases include 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. The official recommendation is to upgrade to 10.0.8.13 or 12.1.1.3 respectively.

The CVSS score of 4.2 indicates moderate severity. The EPSS score is not available, suggesting a low to moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so confirmed public exploits are not known. Likely attack vectors involve remote API requests where a forged or otherwise excluded token is submitted that bypasses the validation logic.