A recent vulnerability in IBM API Connect allows a remote authenticated attacker to bypass authentication controls, enabling unauthorized access to protected APIs or data. The flaw originates from improper authentication handling, identified as CWE‑287, and grants an attacker who owns valid credentials the ability to elevate privileges or circumvent security restrictions.

IBM has identified this weakness in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Organizations using any of these release ranges should audit their deployments for the presence of these versions and plan remediation accordingly.

The vulnerability carries a high CVSS score of 8.1, indicating significant potential for impact. While no EPSS score is available and the flaw is not listed in the CISA KEV catalog, the lack of these metrics does not diminish the threat to systems in the affected ranges. The attack vector is inferred to be remote and requires an authenticated session, meaning an attacker must first acquire or guess legitimate credentials—possibly through credential reuse or compromise—to exploit the flaw. Given the severity value, the risk to exposed instances remains substantial until the fix is applied.