The vulnerability allows a remote attacker to bypass authentication checks, enabling unauthorized access to protected API resources. This authentication bypass originates from inconsistent application of authentication logic, which can lead to elevated privileges and potential exposure of sensitive data. The weakness is identified as CWE‑287, reflecting improper authentication.

Affected are IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The impacted product is IBM API Connect, a gateway and management platform for web services and APIs. The vulnerability exists across the listed releases, so any deployment of these versions is susceptible.

The CVSS score of 6.5 indicates moderate severity, and the EPSS is not available, so current exploitation probability is uncertain. The vulnerability is not referenced in CISA's KEV catalog, implying no known widespread exploitation yet. A remote attacker could exploit the weakness by sending crafted authentication requests from outside the protected network, as the checks are not uniformly enforced. Because authentication is a core access control mechanism, the risk profile is elevated for environments that expose API Connect to untrusted clients.