IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw that allows a remote attacker to acquire valid access tokens for other users. The flaw arises from improper enforcement of authentication against a connected directory service, creating an authentication bypass that can be exploited to impersonate any user. This weakness, classified as CWE‑287, enables an attacker to gain unauthorized access to protected resources and potentially elevate privileges within the environment.

The affected product is IBM API Connect. Versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are impacted. No other IBM products or versions are listed as affected by this vulnerability.

The CVSS score of 9.8 indicates a critical severity that can lead to complete compromise of user credentials. The EPSS score is not available, so the likelihood of exploitation is unknown, but the vulnerability is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation has been documented. Nevertheless, the flaw permits remote exploitation without authentication, and attackers could send specially crafted requests to the API to retrieve or forge access tokens. Organizations should consider the high risk posed by this authentication bypass and apply the vendor's recommended patch promptly.