IBM API Connect 12.1.0.0 through 12.1.1.2 contain an authentication bypass that allows a remote attacker to obtain sensitive information and take control of gateway configuration through an alternate authentication path, potentially leading to full control over the API management infrastructure.

The vulnerability affects IBM API Connect 12.1.0.0 through 12.1.1.2, and any deployments that use those product versions. No version newer than 12.1.1.2 is known to be impacted.

The CVSS score is 9.8, indicating critical severity, and the EPSS score is not available, but the lack of a known exploit in KEV suggests the vulnerability is not yet in the wild. However, the authentication bypass can be invoked remotely, making the attack very likely if the affected product is exposed to untrusted networks.