IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an improper neutralization of user‑supplied input that allows a remote authenticated attacker to execute cross‑site scripting (XSS). The weakness is a classic client‑side script injection (CWE‑79) that can lead to session hijacking, defacement, or malicious data exfiltration. The vulnerability requires authentication and can be triggered by supplying crafted input to susceptible API or UI endpoints.

Affected installations are IBM API Connect released as 12.1.0.0 and 12.1.1.2. The product is identified by the CPE strings for these release numbers. Any deployment of IBM API Connect that has not yet been updated to version 12.1.1.3 remains vulnerable.

The CVSS score of 5.4 indicates moderate severity; the EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated session and the attacker must submit malicious input to the vulnerable component, likely through the management console or exposed API. While the vulnerability is not publicly exploited, its presence means an attacker could inject arbitrary scripts into clients that view untrusted API responses.