IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow remote attackers to conduct unauthenticated brute‑force attacks against the authentication endpoints. The flaw stems from an improper restriction of excessive authentication attempts, enabling an attacker to discover valid credentials. This represents a credential theft vulnerability, classified as CWE‑307.

IBM API Connect from version 10.0.8.0 up to 10.0.8.12, and from 12.1.0.0 up to 12.1.1.2 is impacted. Systems running any of these releases are susceptible to the brute‑force exploitation described above.

With a CVSS score of 8.9, this vulnerability is considered high severity. The EPSS score is not available, so the current estimate of exploitation probability is unknown, and it is not listed in CISA's KEV catalog. The likely attack vector is remote over the network, requiring only connectivity to the API Connect authentication interface. An attacker can repeatedly send credential requests without authentication to discover valid usernames and passwords. No public exploit code is reported, but the nature of the vulnerability makes it straightforward to automate.