IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross‑site request forgery flaw that can force an authenticated user to authenticate into an account controlled by an attacker. The flaw lies in the sign‑in flow, which does not verify that a login response belongs to the user’s own request, allowing the attacker to hijack the user’s session and gain access to the attacker’s account. The impact is not arbitrary code execution but unauthorized access that can expose sensitive data or privileged functions associated with the victim’s account.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. IBM recommends addressing the vulnerability immediately by upgrading to 10.0.8.13 or 12.1.1.3. The fixes are available via Fix Central at the provided links.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not publicly available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, web‑based CSRF; an attacker must entice an authenticated user to visit a crafted URL or click a malicious link. Successful exploitation leads to session hijacking and account takeover, compromising confidentiality and integrity of the victim’s data but not providing arbitrary code execution.