IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 may permit a remote attacker to bypass security restrictions because the product does not properly neutralize special elements in request parameters, a weakness identified as CWE‑918. This flaw allows specially formed requests to be handled unsafely, enabling an attacker to circumvent protections that were intended to enforce authentication or authorization checks.

The affected products are IBM API Connect as reported by IBM. Vulnerable versions include 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2. Applying the official IBM fixes for 10.0.8.13 or 12.1.1.3 updates the system to a hardened state.

The CVSS score of 6.1 indicates a moderate severity. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, which suggests no widespread exploitation has been documented. The likely attack vector is an external network attacker positioning an HTTP request with carefully crafted parameters aimed at the API endpoint. Because the flaw directly enables bypass of security controls, successful exploitation could grant elevated privileges or unauthorized access to protected API resources.