IBM API Connect 12.1.0.0 through 12.1.1.2 contains a hard‑coded cryptographic key that can be accessed by a remote attacker, potentially allowing the retrieval of sensitive data. The flaw is classified as CWE-321, reflecting improper key management. Because the key is embedded in the software distribution, the disclosure can occur without user interaction or additional vulnerabilities.

Products affected are IBM API Connect version 12.1.0.0 and 12.1.1.2. The vulnerability impacts any deployment of these versions and does not affect later releases such as 12.1.1.3.

The CVSS score of 6.5 indicates a medium severity level. The EPSS score is not available, so the rate of exploitation remains unknown; there is no listing in the CISA KEV catalog. Based on the description, the likely attack vector is remote network access to the API Connect instance, allowing an attacker to retrieve the hard‑coded key or use it to decrypt data that should otherwise be protected.