IBM urged customers to patch a critical authentication bypass vulnerability in its API Connect enterprise platform that could allow attackers to access apps remotely. API Connect is an application programming interface (API) gateway that enables organizations to develop, test, and manage APIs and provide controlled access to internal services for applications, business partners, and external developers. Available in on-premises, cloud, or hybrid deployments, API Connect is used by hundreds of companies in banking, healthcare, retail, and telecommunications sectors. Tracked as CVE-2025-13915 and rated 9.8/10 in severity, this authentication bypass security flaw affects IBM API Connect versions 10.0.11.0 and 10.0.8.0 through 10.0.8.5. Successful exploitation enables unauthenticated threat actors to remotely access exposed applications by circumventing authentication in low-complexity attacks that don't require user interaction. IBM asked admins to upgrade vulnerable installations to the latest release to block potential attacks and provided mitigation measures for those who can't immediately deploy the security updates. "IBM API Connect could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application. IBM strongly recommends addressing the vulnerability now by upgrading," the tech giant said. "Customers unable to install the interim fix should disable self-service sign-up on their Developer Portal if enabled, which will help min...
IBM warns of critical API Connect auth bypass vulnerability
BleepingComputer
·Sergiu Gatlan
·Published Dec 31, 2025
·Updated
Affected Software
1 affected component
IBM API Connect=10.0.11.0, >=10.0.8.0<=10.0.8.5
Frequently Asked Questions
1
What is the nature of the vulnerability reported by IBM?
IBM reported a critical authentication bypass vulnerability in its API Connect platform.
2
What potential risk does this vulnerability pose to users?
This vulnerability could allow attackers to access applications remotely without proper authentication.
3
Which software product is specifically affected by this vulnerability?
The affected product is IBM API Connect.
4
What action has IBM advised its customers to take regarding this security issue?
IBM urged customers to apply patches to address the authentication bypass vulnerability.
5
When was the warning about this vulnerability published?
The warning was published on December 31, 2025.