IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 permit a remote authenticated attacker to inject arbitrary HTML into the web interface or API responses. The flaw stems from inadequate neutralization of user‑supplied input, creating a classic cross‑site scripting vulnerability (CWE‑80). Successfully injected scripts can steal browser‑stored credentials, deface content, or perform other actions within the victim’s session.

Systems affected are IBM API Connect installations with any of the releases mentioned above. The product has shipped two sequential improvement lines: the 10.x series up to 10.0.8.12 and the 12.x series up to 12.1.1.2. Both are vulnerable. IBM has released patch updates that address the issue: version 10.0.8.13 and 12.1.1.3 are the earliest fixes.

The CVSS score of 4.3 reflects a medium severity because the vulnerability requires a valid authenticated session. EPSS is unavailable; it is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation, but the possibility remains if credentials are compromised via phishing or credential reuse. Attackers can trigger the injection remotely over the network once they own an authenticated session.