Critical IBM API Connect Authentication Bypass Prompts Urgent Patching
Vulnerability Disclosure · 7 sources · Updated 19m ago · First seen Dec 17, 2025
IBM released interim fixes for CVE-2025-13915, a critical authentication-bypass vulnerability in IBM API Connect with a CVSS v3.1 score of 9.8. Discovered during IBM’s internal testing, the flaw could allow a remote, unauthenticated attacker to gain unauthorized application access without user interaction. It affects versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0. Singapore’s Cyber Security Agency also issued an alert recommending immediate remediation.
Organizations should apply IBM’s interim fixes or upgrade to a remediated release. If patching is not immediately feasible, IBM advises disabling Developer Portal self-service sign-up, if enabled, to reduce exposure; this is a mitigation rather than a substitute for patching. Administrators must also remove remediation-related image overrides before upgrading to the next release or fixpack. Security teams should assess exposed deployments and downstream services that rely on API Connect authentication, where a bypass could undermine inherited access controls.
