IBM webMethods Integration Server 12.1 may allow a remote attacker who has already authenticated to bypass security restrictions through improper backup code validation during two‑factor authentication. The flaw is an authentication bypass that could enable unauthorized access to protected data and functions, effectively allowing a privileged attacker to impersonate a legitimate user. This vulnerability is a classic example of CWE-287, where the system fails to securely validate user credentials.

The vulnerability affects IBM webMethods Integration Server 12.1, including releases 12.1.0 and later minor updates that match the cpe patterns. Systems running these versions are impacted; no other versions are currently listed as vulnerable.

The CVSS score of 8.1 indicates moderate to high potential impact. The EPSS score is not available, so exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. However, because the flaw requires an authenticated user, any compromised or stolen credentials could be leveraged to bypass security controls, making it a significant threat for organizations that cannot enforce strict credential protection.