The flaw in IBM API Connect is an incorrect handling of cryptographic signatures, which permits a remote attacker to forge authentication credentials. By exploiting this weakness the attacker can bypass the normal login process and assign themselves any role within the system, thereby gaining privileged access to APIs, data, and administrative functions without authorization.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. Organizations using these releases are at risk of unauthorized access and role escalation unless patched.

The vendor rates the severity as CVSS 7.4, indicating a high potential impact. While an EPSS score is not available, the vulnerability is not listed in CISA’s KEV catalog, but that does not negate the risk. The flaw can be exploited remotely by sending crafted requests that bypass authentication, so any exposed API endpoints become entry points. The impact on confidentiality, integrity, and availability is significant because an attacker could alter service configurations, access protected data, or disrupt API traffic.