CSO Online

Cyble

InfoWorld

IBM has disclosed a critical authentication bypass vulnerability identified as CVE-2025-13915, affecting its API Connect software. This flaw possesses a severity rating of 9.8 out of 10 on the CVSS scale, highlighting the urgent nature of this security issue. Impacted versions include 10.0.8.0 through 10.0.8.5 and 10.0.11.0. The vulnerability allows remote attackers to bypass authentication measures, gaining unauthorized access without requiring user interaction.
The flaw challenges a core architectural assumption of API gateways, which is that these gateways enforce strong identity and trust. Consequently, services downstream of the API gateway may unwittingly inherit unearned trust, amplifying the risk and complexity of potential exploits. IBM detected this serious issue during its internal testing processes and has proactively released interim fixes. These patches are readily available through IBM’s Fix Central.
Users and organizations who are impacted and unable to apply these necessary fixes immediately are strongly advised to disable the self-service sign-up feature on their Developer Portal as a temporary mitigation strategy. Although no active exploitation of the vulnerability has been recorded to date, these preventive measures are crucial to safeguard affected systems.
Singapore’s Cyber Security Agency has also flagged this vulnerability, reaffirming its critical nature and emphasizing the need for immediate patching. However, it’s worth noting that the vulnerability has not yet appeared in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog.
Looking forward, the process of overriding these patches in future software upgrades will require careful planning to ensure that security is not compromised further. Organizations are encouraged to remain vigilant and prioritize applying security updates as promptly as possible to address this significant threat.

Collections

IBM disclosed CVE-2025-13915, a critical authentication bypass vulnerability (CVSS 9.8) in API Connect versions 10.0.8.0-10.0.8.5 and 10.0.11.0. The flaw allows remote attackers to bypass authentication without user interaction, undermining the trust model of API gateways and potentially affecting downstream services. IBM released interim fixes via Fix Central, and recommends disabling self-service sign-up on Developer Portal as temporary mitigation. No active exploitation has been observed, but Singapore's Cyber Security Agency has flagged it as critical requiring immediate patching.

IBM Discloses Critical Authentication Bypass Vulnerability in API Connect