IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a cross‑site request forgery weakness that allows an attacker who can trigger a sign‑in action to cause a legitimate user to authenticate to an account under the attacker's control. The vulnerability arises because the sign‑in flow does not adequately confirm that the login response corresponds to the original request, resulting in the victim’s session being linked to a different account. As a consequence an attacker can hijack a user’s authenticated session and gain unauthorized access to resources associated with the attacker‑controlled account.

The affected software is IBM API Connect. Vulnerable versions are 12.1.0.0 and 12.1.1.2. IBM has advised customers to upgrade to version 12.1.1.3 to remediate the flaw.

The CVSS score of 5.4 indicates a moderate impact, and the vulnerability is not listed in the CISA KEV catalog. No EPSS value is available, so the historical exploitation likelihood is unknown. Attackers would need the ability to influence a victim’s web browser to target the API Connect sign‑in endpoint; if successful, the attacker can force the victim to authenticate to an attacker‑controlled account. The attack vector is inferred to be remote via the web interface, requiring that the victim visit a crafted URL or page that submits a forged authentication request.