IBM API Connect web services running versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw that allows an attacker to bypass authentication and inject unauthorized configuration changes because certificate validation is improperly performed. The vulnerability is a direct security weakness that could lead to complete compromise of the API Connect instance, resulting in loss of confidentiality, integrity, and availability of services hosted on the appliance.

The affected products are IBM API Connect 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. IBM recommends upgrading to version 12.1.1.3 for the 12.x line and to 10.0.8.13 for the 10.x line. Any instance still using the listed versions remains susceptible.

The CVSS score is 8, indicating a high severity issue. The EPSS score is not available, meaning the current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, originating from a network attacker able to reach the API Connect web interface. An attacker would need to have the ability to send crafted HTTPS requests to the API endpoints, and the flaw permits bypassing authentication checks, enabling policy changes or other administrative actions.