IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to enumerate usernames by observing differences in response behavior. This issue could disclose valid usernames but does not impact confidentiality, integrity, or availability beyond that.