The vulnerability is an improper authentication flaw (CWE‑290) that allows a remote attacker to impersonate a legitimate user. By supplying forged identity information in API requests, the attacker can bypass authentication checks, obtain sensitive data and modify API configurations. This grants the adversary unauthorized access to protected resources and the ability to alter the behavior or availability of the API portal.

Affected products are IBM API Connect version 12.1.0.0 through 12.1.1.2. The flaw exists across all deployments of these releases, as indicated by the CPE ranges for 12.1.0.0 and 12.1.1.2. No later versions beyond 12.1.1.2 are listed as vulnerable, so versions 12.1.1.3 and greater are considered fixed.

The CVSS score of 9.4 denotes critical severity. With no EPSS data available and the vulnerability not listed in CISA KEV, the empirical risk of exploitation in the wild remains uncertain, but the high CVSS indicates that once discovered, exploitation would allow remote compromise. The attack vector is inferred to be remote via the exposed API endpoint, requiring only crafted requests; therefore, any system exposed to external networks is at risk.