IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a weakness that allows a remote attacker with valid credentials to retrieve sensitive data from the system because credentials are not adequately protected. The flaw is classified as CWE‑522, which indicates insufficiently protected credentials and can result in an unauthorized viewer obtaining authentication tokens, passwords, or other protected information. The impact is primarily a confidentiality breach, where access to confidential information is granted to an attacker who has the right to authenticate.

Affected systems are IBM’s API Connect product, with vulnerability present in versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Administrators should verify their deployment against these specific release numbers to determine exposure.

The CVSS score of 5.4 positions the vulnerability in the moderate severity range. EPSS information is not available, so the current exploitation probability is unknown, but the flaw is not listed in the CISA KEV catalog. Because the attack requires authenticated access, the probability of exploitation depends on the number of compromised accounts; once an attacker obtains valid credentials, extraction of sensitive data becomes trivial. The risk is therefore moderate, with the main concern being the potential for confidential information leakage if credentials are exposed.